What is the CVSS score of CVE-2026-2233?

CVE-2026-2233 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2233?

Organizations using User Registration should be aware of moderate risk from CVE-2026-2233, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-2233?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-2233

EUVD-2026-12202 MEDIUM

Missing Authorization (CWE-862)

2026-03-15 Wordfence

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 03:00 euvd

EUVD-2026-12202

Analysis Generated

Mar 15, 2026 - 03:00 vuln.today

CVE Published

Mar 15, 2026 - 02:19 nvd

MEDIUM 5.3

DescriptionCVE.org

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.

AnalysisAI

Unauthenticated attackers can modify arbitrary WordPress posts through the User Frontend plugin (versions up to 4.2.8) due to missing authorization checks in the draft_post() function, allowing them to unpublish or alter post content. The vulnerability affects all installations of the affected plugin versions without requiring authentication or user interaction. No patch is currently available.

Technical ContextAI

The User Frontend plugin is a WordPress plugin designed for frontend user interactions including post submission, user directories, and profile management. The vulnerability stems from CWE-862 (Missing Authorization/Capability Check), where the draft_post() function fails to verify whether the requesting user possesses the necessary WordPress capabilities before allowing post modification operations. WordPress enforces capability checks through its permissions API, and this plugin bypasses those checks entirely. The affected technology stack involves PHP-based WordPress post manipulation functions without proper use of current_user_can() checks, allowing any HTTP request (authenticated or not) to invoke post state changes. The plugin's reliance on the 'post_id' parameter as the sole identifier for targeting posts compounds the issue, as enumeration of post IDs is trivial in WordPress environments.

RemediationAI

Immediately upgrade the User Frontend plugin to version 4.2.9 or later, which should include the capability check fix. This can be performed through the WordPress dashboard under Plugins > Installed Plugins by clicking 'Update Now' if an update is available, or by manually downloading and uploading the latest version from the WordPress.org plugin repository. Until patching is completed, implement temporary mitigations by restricting HTTP access to WordPress administrative endpoints via web application firewall rules or reverse proxy configuration, disabling the plugin if functionality is not immediately required, and auditing recent post modification logs via WordPress audit plugins to detect unauthorized changes. Monitor post revisions and maintain verified backups to enable recovery if posts are modified without authorization. Consider implementing additional role-based access controls through WordPress user capability management to minimize the blast radius of unauthenticated requests.