Vulnerabilidades do Glowlogix WP Frontend Profile
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Glowlogix WP Frontend Profile: 2 registro(s), com versões afetadas e correções.
CVE-2026-39688
Média · 5.3
CWE-862 08/04/2026
WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.
CVE-2026-1644
Média · 4.3
CWE-352 06/03/2026
WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection
The WP Frontend Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing nonce validation on the 'update_action' function. This makes it possible for unauthenticated attackers to approve or reject user account registrations via a forged request granted they can trick an administrator into performing an action such as clicking on a link.