WordPress security by component
User Frontend
Plugin description
User Frontend is a WordPress component with 17 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
wp-user-frontendLatest vulnerability
CVE-2026-14568: User Frontend permits unauthenticated deletion of guest attachments
User Frontend before 4.3.8 deletes an attachment without first confirming that the requester owns it. An unauthenticated attacker can permanently delete author-less attachments, including guest uploads and plugin placeholder media, by supplying the targeted attachment to the vulnerable deletion operation. The CNA record does not disclose the handler, action, parameter names or deletion function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-14568
User Frontend permits unauthenticated deletion of guest attachments
User Frontend before 4.3.8 deletes an attachment without first confirming that the requester owns it. An unauthenticated attacker can permanently delete author-less attachments, including guest uploads and plugin placeholder media, by supplying the targeted attachment to the vulnerable deletion operation. The CNA record does not disclose the handler, action, parameter names or deletion function.
|
4.3.8 |
CVE6.5
NVDPending
|
| Jul 09, 2026 |
CVE-2026-12418
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration: A security weakness
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.7.
|
> 4.3.7 |
CVE5.3
NVDPending
|
| Jul 09, 2026 |
CVE-2026-12406
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration: A security weakness
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.7.
|
> 4.3.7 |
CVE5.3
NVDPending
|
| Jun 29, 2026 |
CVE-2026-57334
WP User Frontend: A security weakness
WP User Frontend is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 4.3.7.
|
4.3.8 |
CVE6.5
NVDPending
|
| May 08, 2026 |
CVE-2026-5127
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Code execution
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 4.3.1.
|
> 4.3.1 |
CVE8.8
NVDPending
|
| Apr 29, 2026 |
CVE-2026-42412
WP User Frontend: A security weakness
WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 4.3.1.
|
4.3.2 |
CVE6.5
NVDPending
|
| Mar 25, 2026 |
CVE-2026-32485
WP User Frontend: A security weakness
WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through <= 4.2.8.
|
4.2.9 |
CVE7.5
NVDPending
|
| Mar 25, 2026 |
CVE-2026-24364
WP User Frontend: A security weakness
WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.2.5.
|
4.2.6 |
CVE6.5
NVDPending
|
| Feb 26, 2026 |
CVE-2026-1565
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Dangerous file upload
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration is affected by dangerous file upload. Exploitation requires at least author-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jan 02, 2026 |
CVE-2025-14047
Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend: A security weakness
Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Sep 22, 2025 |
CVE-2025-58673
WP User Frontend: Code execution
WP User Frontend is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Sep 22, 2025 |
CVE-2025-58672
WP User Frontend: A security weakness
WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Jan 02, 2025 |
CVE-2023-45002
WP User Frontend: A security weakness
WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Aug 29, 2024 |
CVE-2024-38693
WP User Frontend: SQL injection
WP User Frontend is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
NVD7.2
|
| May 17, 2024 |
CVE-2023-47682
WP User Frontend: Privilege escalation or authentication bypass
WP User Frontend is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Nov 21, 2022 |
CVE-2021-24649
WP User Frontend: A security weakness
WP User Frontend is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Jan 24, 2022 |
CVE-2021-25076
WP User Frontend: SQL injection
WP User Frontend is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD8.8
|