EUVD-2026-67568
GHSA-vwp5-qxw4-4vgw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-exposed unauthenticated endpoint with no complexity; confidentiality limited to PII fields only, no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
AnalysisAI
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the email address and phone number of every registered user - including site administrators - via an unrestricted user directory search endpoint. The flaw requires no authentication, no special configuration, and is automatable per SSVC, making bulk harvesting trivial for any remote attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the User Frontend plugin being installed and active on a WordPress site running a version in the 4.3.0-4.3.9 range - the vulnerable endpoint is exposed by default with no non-default configuration needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (Medium) reflects a network-accessible, unauthenticated, low-complexity attack with no user interaction required, but only partial confidentiality impact and no integrity or availability impact - a characterization that is consistent with a mass PII enumeration flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the User Frontend WordPress plugin to version 4.3.10 or later, which contains the vendor-released patch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Frontend
View allPHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Ed
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to perman
Authorization bypass in the WP User Frontend (WPUF) WordPress plugin through version 4.3.7 allows unauthenticated visito
Unauthenticated content tampering in the WP User Frontend WordPress plugin (all versions through 4.3.7) allows any visit
Insecure Direct Object Reference in weDevs WP User Frontend plugin (all versions ≤4.3.1) allows unauthenticated network
Unauthorized subscription cancellation in weDevs User Frontend WordPress plugin (all versions through 4.3.2) allows any
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today