Improper Authentication Vulnerability in User Frontend Plugin for WordPress
CVE-2026-14568
What is CVE-2026-14568?
The User Frontend plugin for WordPress prior to version 4.3.8 contains a flaw that allows unauthorized users to delete attachments without proper verification of ownership. This flaw can be exploited by unauthenticated attackers, enabling them to permanently remove media uploaded by users without permission, including guest uploads and placeholder media. This security lapse poses a risk to data integrity and could lead to the loss of important user-generated content.
Affected Version(s)
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration 0 < 4.3.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.