CVE-2026-52708

MediumCVSS 4.3/10Last modified Oct 29, 2026

Description

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-527096.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gal CVE-2026-52717.8pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. CVE-2026-527105.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for Wo CVE-2026-527117.5Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.CVE-2026-527127.6Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.CVE-2026-527135.4Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve CVE-2026-527145.9Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.CVE-2026-527159.3Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.CVE-2026-527166.5Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.CVE-2026-527186.5A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() fun CVE-2026-527197.1An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length CVE-2026-52728.8Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML