WP User Frontend CVE-2026-12418

The WordPress site must have the WP User Frontend plugin installed and active in a version at or below 4.3.7. At least one WPUF post submission form must be rendered on a page accessible to unauthenticated visitors - which is the plugin's intended purpose and typical deployment configuration, so this is not a restrictive condition. The wpuf_submit_post AJAX action must be reachable, which it is by default on any WordPress site with the plugin active, as WordPress registers AJAX actions for both logged-in (wp_ajax_) and non-logged-in (wp_ajax_nopriv_) users. A valid nonce is required, but nonces are embedded in the public form page and obtainable by any page visitor without authentication. Exploitation is limited to overwriting three specific post fields (post_title, post_content, post_excerpt) and does not grant code execution, file access, or administrative account creation. Sites that have no public-facing WPUF submission forms (e.g., the plugin is installed but forms are restricted to logged-in users only) face reduced but not eliminated risk if any authenticated user can access a form.

The official CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N is technically accurate per metric definitions but understates the operational impact for content-dependent sites. The I:L rating reflects limited integrity modification (three specific fields), yet the attacker can target any post - including high-visibility pages, published articles, and administrator-authored content - making mass defacement of an entire WordPress site feasible from a single unauthenticated request. No EPSS data was provided in the intelligence feed. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis, which moderates urgency. The attack vector (AV:N) and privilege level (PR:N) are confirmed by the description, which explicitly states exploitation requires no WordPress role. The primary limiting factor is that a WPUF post submission form must exist and be reachable, but the plugin's purpose is to surface such forms to non-authenticated users, meaning this condition is met by the typical deployment intent. Risk is real but focused on content integrity rather than confidentiality or system compromise.

An unauthenticated attacker identifies a WordPress site running WP User Frontend by locating a public post submission form (the plugin's primary use case). The attacker crafts a POST request to wp-admin/admin-ajax.php with action=wpuf_submit_post, a valid nonce obtained from the public form, and a manipulated wpuf_files_data parameter containing the ID of a target post - such as the site's homepage or a pinned admin article. The post's title, content, and excerpt are overwritten with attacker-controlled text, defacing the targeted content without any authentication. No public proof-of-concept code has been identified at time of analysis, but the attack is straightforward to reconstruct from the description and referenced source code.