# CVE-2026-75824: User Frontend WordPress plugin account creation bypass with registration disabled

Source: https://junglewise.ai/threats/cve-2026-75824-the-user-frontend-wordpress-plugin-before-4-3-12-does-not-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-75824 · Severity: info · Published 2026-09-30

The User Frontend WordPress plugin allows unauthenticated users to create accounts on WordPress sites even when the site administrator has disabled user registration. Attackers can gain unauthorized account access with default user privileges, potentially leading to unauthorized content access, spam, or further privilege escalation.

## Quick answers

**Is CVE-2026-75824 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75824 being exploited in the wild.

**How severe is CVE-2026-75824?** Informational severity, published 30 September 2026.

**Which products and versions are affected?** WP User Frontend User Frontend 2.5.8 to 4.3.11.

**Is there a fix for CVE-2026-75824?** A patch was published on 2026-09-30: Fixed in version 4.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75824 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75824?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to validate the site's user registration policy before creating accounts via its account creation functionality. An unauthenticated attacker can bypass access controls by directly invoking the account creation mechanism, receiving the site's default user role. The vulnerability affects versions 2.5.8 through 4.3.11 and is fixed in 4.3.12.

## Affected products

- WP User Frontend User Frontend 2.5.8 to 4.3.11

## Timeline

- 2026-09-28: disclosed
- 2026-09-30: patched: Fixed in version 4.3.12

## References

- [https://wpscan.com/vulnerability/61b04ece-5050-465e-aa11-de2ff79c6e8c/](https://wpscan.com/vulnerability/61b04ece-5050-465e-aa11-de2ff79c6e8c/)