User Frontend permits unauthenticated deletion of guest attachments
User Frontend before 4.3.8 deletes an attachment without first confirming that the requester owns it. An unauthenticated attacker can permanently delete author-less attachments, including guest uploads and plugin placeholder media, by supplying the targeted attachment to the vulnerable deletion operation. The CNA record does not disclose the handler, action, parameter names or deletion function.
- Component
- User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
- Plugin slug
wp-user-frontend- Affected
- < 4.3.8
- Safe version
4.3.8- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 17 known issues for this plugin.
Update, patch or deactivate.
Update User Frontend to 4.3.8 or later. Check media records and storage for missing guest uploads or placeholder files, restore deleted content from a known-good backup and review request logs for repeated attachment-deletion attempts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L