Privilege Escalation in User Frontend Plugin for WordPress
CVE-2026-120070
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 October 2026
What is CVE-2026-120070?
The User Frontend plugin for WordPress is susceptible to privilege escalation due to a flaw in its submit_post() function. This vulnerability allows authenticated users with a Subscriber role or higher to exploit the post_content parameter. The issue arises because the plugin's shortcode validation fails, permitting the injection of malicious shortcodes into published posts. Specifically, attackers can create a registration form for an Editor role that can be publicly submitted, enabling unauthorized users to gain elevated access with privileges of an Editor. Immediate action should be taken to update any affected versions to mitigate potential exploitation.
Affected Version(s)
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 0 <= 4.3.13