WP User Frontend

WP User Frontend through 4.3.10 accepts serialized data from Subscriber-level users and can instantiate PHP objects. A usable gadget chain on the site can turn the object-injection primitive into code execution or other high-impact behavior.

WP User Frontend before 4.3.11 permits user-supplied field values to be deserialized when a submitted post is reopened in the front-end editing form. A Subscriber or higher can inject PHP objects, potentially leading to remote code execution when a suitable gadget chain is present on the site.

User Frontend before 4.3.8 deletes an attachment without first confirming that the requester owns it. An unauthenticated attacker can permanently delete author-less attachments, including guest uploads and plugin placeholder media, by supplying the targeted attachment to the vulnerable deletion operation.

User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 4.3.7.

User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.7.

WP User Frontend is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.3.7.

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 4.3.1.

WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 4.3.1.

WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through <= 4.2.8.

WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.2.5.

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration is affected by dangerous file upload. Exploitation requires an authenticated author account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP User Frontend is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP User Frontend is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

WP User Frontend is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP User Frontend is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.