User Frontend CVE-2026-14567

No special conditions are required beyond the User Frontend plugin being installed and active on a WordPress site running a version in the 4.3.0-4.3.9 range - the vulnerable endpoint is exposed by default with no non-default configuration needed. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default plugin configurations. What limits exploitation: the attacker must be able to reach the WordPress site over the network, and the specific endpoint path must be known or discovered (trivial via the public POC); the impact is limited to confidentiality of PII (email and phone) and does not extend to authentication bypass, remote code execution, or integrity modification.

The CVSS 3.1 base score of 5.3 (Medium) reflects a network-accessible, unauthenticated, low-complexity attack with no user interaction required, but only partial confidentiality impact and no integrity or availability impact - a characterization that is consistent with a mass PII enumeration flaw. SSVC signals reinforce the automatable:yes designation, meaning a single script can enumerate the entire user database without manual intervention; however, SSVC exploitation is rated 'none' at time of analysis and CISA KEV confirms no active exploitation. EPSS data was not provided, limiting probabilistic exploitation forecasting. The most consequential signal here is the publicly available POC combined with the automatable nature: while the CVSS score is medium, the ease of bulk PII exfiltration - including admin email addresses usable in targeted phishing or credential stuffing - elevates practical risk above what the raw score implies. The vendor CPE lists the vendor as 'unknown,' which limits independent verification of deployment scope.

An attacker identifies a WordPress site running the vulnerable User Frontend plugin, then sends automated unauthenticated HTTP GET or POST requests to the exposed user directory search endpoint with wildcard or empty query parameters. The endpoint returns structured data containing email addresses and phone numbers for all registered users including administrators, which the attacker harvests for targeted phishing campaigns or credential stuffing attacks. A publicly available POC reduces the skill threshold for exploitation to near zero.