CVE-2025-62072
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Front End Users plugin for WordPress has a missing authorization vulnerability affecting versions up to and including 3.2.33. The issue allows unauthorized access to functions that should require appropriate permissions.
Risk Assessment
An attacker can exploit the missing authorization to perform operations without proper permissions, potentially leading to unauthorized changes in configuration or user data.
Recommendation
Update the plugin to the latest version that includes the fix. Also review permission configuration to ensure access to sensitive functions is properly restricted.
Other vulnerabilities in Front End Users
See all- CVE-2026-87835Medium
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms. This allows unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the plugin's content restrictions and registration gating.
- CVE-2025-58235Medium
The Front End Users WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.
Original NVD description (English source)
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS