What is the CVSS score of CVE-2026-12418?

CVE-2026-12418 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

WP User Frontend CVE-2026-12418

EUVD-2026-42542 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-09 Wordfence

GHSA-33x8-pcvj-97hp

Authentication Bypass WordPress User Frontend

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable AJAX endpoint, no privileges required per description; integrity impact is low as only three specific post fields are modifiable, not full system control.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 09:03 vuln.today

CVE Published

Jul 09, 2026 - 07:55 nvd

MEDIUM 5.3

DescriptionCVE.org

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as the wpuf_submit_post AJAX action is gated only by a nonce with no capability check for the downstream post-edit operation.

AnalysisAI

Unauthenticated content tampering in the WP User Frontend WordPress plugin (all versions through 4.3.7) allows any visitor to overwrite the title, body, and excerpt of any post on the site, including posts authored by administrators. The flaw stems from the wpuf_submit_post AJAX action accepting a user-controlled post reference key in the wpuf_files_data parameter without validating whether the requesting user is authorized to edit the target post - a textbook CWE-639 authorization-through-user-controlled-key failure. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires no authentication and no special configuration beyond the plugin being installed with at least one public-facing submission form.

Technical ContextAI

WP User Frontend (wp-user-frontend) by weDevs is a WordPress plugin enabling frontend post submission, user registration, and profile management. The vulnerability resides in two intersecting code paths: FieldableTrait.php (lines 468 and 478) handles the wpuf_files_data parameter, and Frontend_Form_Ajax.php (line 35) registers the wpuf_submit_post AJAX action. The AJAX handler validates a nonce - which is a CSRF protection, not an authorization mechanism - but performs no capability check before allowing the downstream post-edit operation to proceed. CWE-639 (Authorization Through User-Controlled Key) precisely describes the root cause: the application uses an attacker-supplied post ID as the lookup key to identify which post to modify, without verifying that the authenticated (or unauthenticated) session has write authority over that specific post object. This is distinct from a missing-authentication flaw; the plugin simply trusts the key.

RemediationAI

A patch changeset (revision 3578622) is present in the WordPress plugin Trac repository, indicating a fix has been committed upstream; however, an exact patched release version is not independently confirmed from the available input data. Site administrators should update the WP User Frontend plugin to the latest available version in the WordPress plugin directory and verify the installed version is newer than 4.3.7. If an immediate update is not feasible, the most targeted compensating control is to disable or password-protect all WPUF post submission forms, removing the publicly accessible AJAX action surface entirely - the trade-off being that legitimate frontend posting functionality will be unavailable to users. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php with action=wpuf_submit_post from unauthenticated sessions can mitigate exploitation without disabling the feature, though this may break legitimate use if the plugin is intended for anonymous submissions. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8f66e25f-b67e-4227-95fe-69b40551af61 for updated patch version confirmation.