WP User Frontend CVE-2026-12406

Three specific conditions must all be true for exploitation: (1) the WP User Frontend plugin is installed and active on the WordPress site; (2) at least one WPUF shortcode is rendered on a publicly accessible front-end page - without this, the wpuf_nonce is never localized into public JavaScript and the sole access control gate cannot be satisfied; (3) target media attachments must have post_author = 0, restricting deletable files to those uploaded by guests or via registration-form flows, not by any authenticated WordPress user. Exploitation is blocked on sites that render WPUF shortcodes only behind authentication walls (members-only pages), on sites with no guest file upload workflows, and for any media attachment owned by an authenticated user (post_author != 0). The requirement for a public WPUF shortcode page is the primary limiting factor beyond raw CVSS, and defenders should audit whether this condition applies to their installation before triaging urgency.

The NVD-assigned CVSS 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the constrained but zero-friction attack path. No EPSS score was provided; KEV status is absent, indicating no confirmed in-the-wild exploitation at time of analysis. The real-world risk is deployment-context-dependent: sites that collect guest or anonymous file uploads (common in registration-driven or guest-post workflows) and expose WPUF shortcodes on public pages face meaningful risk of having pending media - registration proof images, submitted documents - systematically deleted. Sites using WPUF exclusively in authenticated or admin-only contexts are not practically exploitable. The nonce-exposure mechanism is a well-understood WordPress anti-pattern, and the attack technique is mechanically derivable from the publicly accessible plugin source without any specialized tooling. The integrity impact is intentionally scoped (I:L, post_author=0 only) but could disrupt registration workflows at scale on affected installations.

An unauthenticated attacker visits any public WordPress page on the target site where a WPUF shortcode (e.g., a guest registration or front-end post submission form) is rendered, then reads the wpuf_nonce value directly from the page's JavaScript context (window.wpuf_upload.nonce). The attacker then iterates attachment IDs starting from low integers and submits POST requests to /wp-admin/admin-ajax.php with action=wpuf_file_del, the extracted nonce, and each target ID, deleting all guest-uploaded media attachments without any account credentials. No exploit code has been publicly released, but the attack is mechanically trivial and fully derivable from the publicly available plugin source referenced in the CVE.