Improper Authentication Vulnerability in User Frontend Plugin for WordPress
CVE-2026-14568

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
User Frontend: Ai Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
Vendor
CVE Published:
27 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14568?

The User Frontend plugin for WordPress prior to version 4.3.8 contains a flaw that allows unauthorized users to delete attachments without proper verification of ownership. This flaw can be exploited by unauthenticated attackers, enabling them to permanently remove media uploaded by users without permission, including guest uploads and placeholder media. This security lapse poses a risk to data integrity and could lead to the loss of important user-generated content.

Affected Version(s)

User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration 0 < 4.3.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14568 - Proof of Concept

References

https://wpscan.com/vulnerability/dcbc2a0c-6fa6-4266-9292-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

kimsunghoon
WPScan
.