CVE-2026-77133EPSS p26.4%

CVE-2026-77133CVE-2026-77133

Description

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Scoring

EPSS0.35% probability of exploitation · percentile 26.4% · 2026-10-05T12:00:23Z
Last modified2026-08-26
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.