CVE-2026-12406
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The User Frontend plugin for WordPress up to version 4.3.7 has an authorization bypass vulnerability. Unauthenticated attackers can delete arbitrary media attachments with post_author 0 via the wpuf_file_del AJAX action.
Risk Assessment
The risk is that unauthenticated visitors can delete files uploaded via guest or registration forms, potentially causing data loss and service disruption.
Recommendation
Update the User Frontend plugin to the latest version immediately. As a temporary workaround, disable the plugin or remove WPUF shortcodes from public-facing pages.
Other vulnerabilities in User Frontend
See all- CVE-2026-5459Medium
The User Frontend plugin for WordPress versions up to 4.3.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the payment_page() function. Missing validation on the 'user_id' parameter allows unauthenticated attackers to activate a free subscription pack for any user, overwriting their existing paid subscription and causing loss of paid features.
- CVE-2026-14558High
The User Frontend WordPress plugin before version 4.3.10 does not properly validate field type definitions and deserializes user-controlled post metadata when rendering submitted posts. Users with Editor-level access and above can inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
- CVE-2026-12418Medium
The User Frontend plugin for WordPress up to version 4.3.7 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'wpuf_files_data' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post, including administrator posts.
Original NVD description (English source)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.