CVE-2026-95525
MediumCVSS 6.5Summary
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
Risk Assessment
A low-privileged user (Subscriber) can delete arbitrary files on the server, potentially leading to data loss or site instability.
Recommendation
Update the WP User Frontend plugin to a version newer than 4.3.11 as soon as a fix becomes available.
Other vulnerabilities in WP User Frontend
See all- CVE-2026-95524Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-95523Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-81283High
The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.
- CVE-2026-57334Medium
The WP User Frontend plugin versions up to 4.3.7 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to functions intended for authenticated users.
Original NVD description (English source)
Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.