What is the CVSS score of CVE-2026-12406?

CVE-2026-12406 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

WP User Frontend CVE-2026-12406

EUVD-2026-42537 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-mfgw-m4gf-rx9j

Authentication Bypass WordPress User Frontend

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable AJAX endpoint, no authentication required (nonce extractable by any visitor), integrity-only impact limited to guest-owned files; no confidentiality or availability dimension applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:57 vuln.today

CVE Published

Jul 09, 2026 - 07:55 nvd

MEDIUM 5.3

DescriptionCVE.org

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.

AnalysisAI

Authorization bypass in the WP User Frontend (WPUF) WordPress plugin through version 4.3.7 allows unauthenticated visitors to delete guest-uploaded media attachments via the wpuf_file_del AJAX action. The plugin's sole access control gate - a WordPress nonce - is self-defeated: when any WPUF shortcode is rendered on a public front-end page, the nonce value is localized into publicly readable JavaScript objects (wpuf_upload and wpuf_frontend), making it trivially extractable by any browser visitor. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, but the zero-authentication, low-complexity attack path makes this trivially reproducible from plugin source code alone.

Technical ContextAI

This CWE-862 (Missing Authorization) flaw resides in the AJAX handler wpuf_file_del, implemented in includes/Ajax/Upload_Ajax.php (lines 257 and 271 in both the 4.3.7 and 4.3.2 SVN tags). WordPress nonces are anti-CSRF tokens, not authorization credentials - they confirm request origin, not requester identity or entitlement. The plugin mistakenly treats possession of a valid wpuf_nonce as sufficient authorization for file deletion. The nonce is emitted via wp_localize_script in includes/Frontend.php (line 88), embedding it into the global JavaScript objects wpuf_upload and wpuf_frontend on any page rendering a WPUF shortcode such as [wpuf-registration] or [wpuf_form]. The handler further restricts deletable targets to attachments with post_author = 0, limiting the blast radius to guest uploads and registration-form files, but does not verify that the requesting party has any ownership or administrative claim over those files. Affected CPE: cpe:2.3:a:wedevs:user_frontend covering all versions through 4.3.7. Source code evidence is confirmed in the WordPress plugin SVN repository by Wordfence.

RemediationAI

Update WP User Frontend to the version released after 4.3.7 that incorporates SVN changeset 3578622 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3578622%40wp-user-frontend&new=3578622%40wp-user-frontend) - confirm the current version number in the WordPress plugin directory before updating, as the exact patched release version was not provided in available data. As a compensating control for sites that cannot immediately update, remove all WPUF shortcodes from publicly accessible front-end pages; this prevents the wpuf_nonce from being localized into public JavaScript, eliminating the attack vector entirely, though it will disable guest posting and front-end registration features. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php where the action parameter equals wpuf_file_del from unauthenticated sessions can suppress exploitation without disabling plugin functionality, though this requires WAF infrastructure capable of inspecting POST bodies. Note that restricting admin-ajax.php by IP is not advised on sites with legitimate anonymous AJAX usage from diverse IP ranges.