Is CVE-2026-57334 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57334 being exploited in the wild.

How severe is CVE-2026-57334?

Medium severity, with a CVSS score of 6.5, published 29 June 2026.

Which products and versions are affected?

weDevs WP User Frontend <= 4.3.7.

Is there a fix for CVE-2026-57334?

A patch was published on 2026-06-29: Version 4.3.8 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57334 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57334?

Check whether you run weDevs WP User Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57334: weDevs WP User Frontend broken access control

Q: Is there a fix for CVE-2026-57334?

A patch was published on 2026-06-29: Version 4.3.8 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57334 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57334?

Check whether you run weDevs WP User Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57334 · Severity: medium · CVSS 6.5 · Published 2026-06-29

WP User Frontend is a WordPress plugin that allows users to create profiles and submit content from the front-end of a website. A security flaw in versions 4.3.7 and earlier allows unauthenticated visitors to perform actions they should not be authorized to do. This could lead to unauthorized modifications of site content or settings, potentially impacting the integrity of the website.

Technologies: weDevs WP User Frontend. Vendors: weDevs.

Quick answers

Is CVE-2026-57334 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57334 being exploited in the wild.
How severe is CVE-2026-57334?: Medium severity, with a CVSS score of 6.5, published 29 June 2026.
Which products and versions are affected?: weDevs WP User Frontend <= 4.3.7.
Is there a fix for CVE-2026-57334?: A patch was published on 2026-06-29: Version 4.3.8 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57334 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57334?: Check whether you run weDevs WP User Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP User Frontend plugin for WordPress is vulnerable to broken access control due to missing authorization (CWE-862) in versions up to and including 4.3.7. This vulnerability allows an unauthenticated remote attacker to bypass intended access restrictions and execute functions that should be restricted to higher-privileged users. The flaw stems from a lack of proper validation of user permissions or nonce tokens. Attackers can exploit this over the network without any user interaction. A fix is available in version 4.3.8.

Affected products

weDevs WP User Frontend <= 4.3.7

Timeline

2026-04-19: other: Vulnerability reported by researcher Tiago Ventura
2026-06-29: disclosed: Vulnerability published by Patchstack and NVD
2026-06-29: patched: Version 4.3.8 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.