High severity · published Aug 29, 2024
CVE-2024-38693
WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WU
WP User Frontend · weDevs
through 4.0.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38693
Third Party Advisory
https://patchstack.com/database/vulnerability/wp-user-frontend/wordpress-wp-user-frontend-plugin-4-0-7-sql-injection-vulnerability?_s_id=cve
More from WP User Frontend
9.8
CVE-2021-24649
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created…
8.8
CVE-2026-81283
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
8.8
CVE-2021-25076
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to…
7.5
CVE-2026-32485
WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability
7.2
CVE-2023-47682
WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerability