What is the CVSS score of CVE-2026-14568?

CVE-2026-14568 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14568?

Yes, a public proof-of-concept exploit is available for CVE-2026-14568. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14568?

Yes, a patch is available for CVE-2026-14568. Update the affected software to the latest version immediately.

User Frontend CVE-2026-14568

EUVD-2026-49082 MEDIUM

Improper Authentication (CWE-287)

2026-07-27 WPScan

GHSA-p8fm-59wc-5xxj

Authentication Bypass WordPress User Frontend

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 18:26 vuln.today

CVSS changed

Jul 27, 2026 - 18:22 NVD

6.5 (MEDIUM)

Patch available

Jul 27, 2026 - 07:01 EUVD

CVE Published

Jul 27, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.

AnalysisAI

Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.