User Frontend
Monthly
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the email address and phone number of every registered user - including site administrators - via an unrestricted user directory search endpoint. The flaw requires no authentication, no special configuration, and is automatable per SSVC, making bulk harvesting trivial for any remote attacker. A publicly available proof-of-concept exploit exists, reported by WPScan, though active exploitation has not been confirmed by CISA KEV at time of analysis.
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.
Unauthenticated content tampering in the WP User Frontend WordPress plugin (all versions through 4.3.7) allows any visitor to overwrite the title, body, and excerpt of any post on the site, including posts authored by administrators. The flaw stems from the wpuf_submit_post AJAX action accepting a user-controlled post reference key in the wpuf_files_data parameter without validating whether the requesting user is authorized to edit the target post - a textbook CWE-639 authorization-through-user-controlled-key failure. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires no authentication and no special configuration beyond the plugin being installed with at least one public-facing submission form.
Authorization bypass in the WP User Frontend (WPUF) WordPress plugin through version 4.3.7 allows unauthenticated visitors to delete guest-uploaded media attachments via the wpuf_file_del AJAX action. The plugin's sole access control gate - a WordPress nonce - is self-defeated: when any WPUF shortcode is rendered on a public front-end page, the nonce value is localized into publicly readable JavaScript objects (wpuf_upload and wpuf_frontend), making it trivially extractable by any browser visitor. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, but the zero-authentication, low-complexity attack path makes this trivially reproducible from plugin source code alone.
Insecure Direct Object Reference in weDevs WP User Frontend plugin (all versions ≤4.3.1) allows unauthenticated network attackers to activate a free subscription tier on behalf of any registered WordPress user by supplying an arbitrary user_id to the payment_page() function, silently overwriting existing paid subscriptions and revoking premium access. The root cause is a missing authorization check on a user-controlled key (CWE-639), and because WordPress user IDs are sequential integers trivially enumerable via the REST API, this is exploitable at scale with no authentication or user interaction. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack path makes this straightforward to weaponize against any site monetizing through this plugin's membership features.
Unauthorized subscription cancellation in weDevs User Frontend WordPress plugin (all versions through 4.3.2) allows any authenticated subscriber to cancel any other user's subscription pack, including administrators. The flaw stems from a missing capability check on the user_subscription_cancel() function, meaning low-privileged users can invoke privileged actions. No public exploit code has been identified and this is not listed in CISA KEV, but the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic insider or account-takeover amplification risk.
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the email address and phone number of every registered user - including site administrators - via an unrestricted user directory search endpoint. The flaw requires no authentication, no special configuration, and is automatable per SSVC, making bulk harvesting trivial for any remote attacker. A publicly available proof-of-concept exploit exists, reported by WPScan, though active exploitation has not been confirmed by CISA KEV at time of analysis.
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to permanently delete author-less attachments, such as guest uploads or placeholder media. The vulnerability stems from missing ownership checks on attachment deletion requests, and a proof-of-concept exploit is publicly available. The vendor has released a patch in version 4.3.8.
Unauthenticated content tampering in the WP User Frontend WordPress plugin (all versions through 4.3.7) allows any visitor to overwrite the title, body, and excerpt of any post on the site, including posts authored by administrators. The flaw stems from the wpuf_submit_post AJAX action accepting a user-controlled post reference key in the wpuf_files_data parameter without validating whether the requesting user is authorized to edit the target post - a textbook CWE-639 authorization-through-user-controlled-key failure. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires no authentication and no special configuration beyond the plugin being installed with at least one public-facing submission form.
Authorization bypass in the WP User Frontend (WPUF) WordPress plugin through version 4.3.7 allows unauthenticated visitors to delete guest-uploaded media attachments via the wpuf_file_del AJAX action. The plugin's sole access control gate - a WordPress nonce - is self-defeated: when any WPUF shortcode is rendered on a public front-end page, the nonce value is localized into publicly readable JavaScript objects (wpuf_upload and wpuf_frontend), making it trivially extractable by any browser visitor. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, but the zero-authentication, low-complexity attack path makes this trivially reproducible from plugin source code alone.
Insecure Direct Object Reference in weDevs WP User Frontend plugin (all versions ≤4.3.1) allows unauthenticated network attackers to activate a free subscription tier on behalf of any registered WordPress user by supplying an arbitrary user_id to the payment_page() function, silently overwriting existing paid subscriptions and revoking premium access. The root cause is a missing authorization check on a user-controlled key (CWE-639), and because WordPress user IDs are sequential integers trivially enumerable via the REST API, this is exploitable at scale with no authentication or user interaction. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack path makes this straightforward to weaponize against any site monetizing through this plugin's membership features.
Unauthorized subscription cancellation in weDevs User Frontend WordPress plugin (all versions through 4.3.2) allows any authenticated subscriber to cancel any other user's subscription pack, including administrators. The flaw stems from a missing capability check on the user_subscription_cancel() function, meaning low-privileged users can invoke privileged actions. No public exploit code has been identified and this is not listed in CISA KEV, but the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic insider or account-takeover amplification risk.