Login Request a demo
Medium severity · published Sep 30, 2026
CVE-2026-75824
WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
User Frontend ·
2.5.8 before 4.3.12 · source: vendor
Affected product
UF
User Frontend
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75824
exploit
https://wpscan.com/vulnerability/61b04ece-5050-465e-aa11-de2ff79c6e8c/
More from User Frontend
8.8
CVE-2026-19116
WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
7.4
CVE-2026-75823
WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
7.2
CVE-2026-14558
WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
5.3
CVE-2026-17563
WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
5.3
CVE-2026-14567
WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory