CVE-2026-87835: CWE-284 Improper Access Control in Front End Users

CVE-2026-87835 is an improper access control vulnerability (CWE-284) in the Front End Users WordPress plugin through version 3.2.35. The plugin does not restrict which account attributes a visitor may set when registering via front-end forms, allowing unauthenticated users to manipulate membership levels and account status flags such as approved, confirmed, and paid. This bypasses intended content restrictions and registration controls enforced by the plugin.

An attacker can escalate privileges by assigning themselves arbitrary membership levels and bypass registration gating mechanisms, potentially gaining unauthorized access to restricted content or features controlled by the plugin. This compromises the integrity of user access controls within affected WordPress sites using this plugin.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the plugin or restricting access to registration forms. Monitor vendor channels for updates and apply patches promptly once released.