Skip to main content

User Frontend EUVDEUVD-2026-49082

| CVE-2026-14568 MEDIUM
Improper Authentication (CWE-287)
2026-07-27 WPScan GHSA-p8fm-59wc-5xxj
WordPress Authentication Bypass User Frontend Unknown
6.5
CVSS 3.1 · Vendor: WPScan
View

Vulnerability Assessment

Weakness
CWE
CWE-287
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK

2 techniques across 2 tactics: Defense Evasion, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.

Affected VersionsENISA

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration 0 <4.3.8

Affected Packages

euvd user_frontend_ai_powered_frontend_post_submission_user_directory_user_profile_membership_user_registration fix: 4.3.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when User Frontend gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (WPScan) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
CVSS changed
Jul 27, 2026 - 18:22 NVD
6.5 (MEDIUM)
Patch available
Jul 27, 2026 - 07:01 EUVD
CVE Published
Jul 27, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 06:00 cve.org
MEDIUM 6.5

DescriptionCVE.org

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.

Threat Intelligence Overview

EPSS Score
0.2%
Top 90% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

52
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in User Frontend

View all
CVE-2026-19116 HIGH POC
8.8 Sep 02

PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-
CVE-2026-14558 HIGH POC
7.2 Aug 28

PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Ed
CVE-2026-17563 MEDIUM POC
5.3 Sep 02

Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a s
CVE-2026-14567 MEDIUM POC
5.3 Aug 28

Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the e
CVE-2026-5127 HIGH
8.8 May 08

PHP object injection in User Frontend plugin for WordPress versions up to 4.3.1 allows authenticated attackers with Subs
CVE-2026-12406 MEDIUM
5.3 Jul 09

Authorization bypass in the WP User Frontend (WPUF) WordPress plugin through version 4.3.7 allows unauthenticated visito
CVE-2026-12418 MEDIUM
5.3 Jul 09

Unauthenticated content tampering in the WP User Frontend WordPress plugin (all versions through 4.3.7) allows any visit
CVE-2026-2233 MEDIUM
5.3 Mar 15

Unauthenticated attackers can modify arbitrary WordPress posts through the User Frontend plugin (versions up to 4.2.8) d
CVE-2026-5459 MEDIUM
5.3 Jul 08

Insecure Direct Object Reference in weDevs WP User Frontend plugin (all versions ≤4.3.1) allows unauthenticated network

CVE-2026-4058 MEDIUM
4.3 Jun 09

Unauthorized subscription cancellation in weDevs User Frontend WordPress plugin (all versions through 4.3.2) allows any

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-14568

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy