User Frontend
Approved changes feed: RSS · Atom
cpe:2.3:a:wedevs:user_frontend:_ai_powered_frontend_posting,_user_directory,_profile_builder,_membership_&_user_registration:*:*:*:*:*:*:*:*
part: a version: _ai_powered_frontend_posting,_user_directory,_profile_builder,_membership_&_user_registration update: *
| Vendor | Wedevs (74af2ef9-c755-5b07-93a2-5a3afa051904) |
|---|---|
| Product | User Frontend (877a484f-f837-58da-8ced-ede67b9f30fc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-5459 |
vulnerable | 2026-07-29 01:03:18.840645 |
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
MEDIUM (5.3)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.
Published: 2026-07-08T12:33:16.401Z
Updated: 2026-07-08T14:00:54.082Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12418 |
vulnerable | 2026-07-29 00:23:32.316108 |
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
MEDIUM (5.3)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as the wpuf_submit_post AJAX action is gated only by a nonce with no capability check for the downstream post-edit operation.
Published: 2026-07-09T07:55:13.665Z
Updated: 2026-07-09T14:39:37.233Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12406 |
vulnerable | 2026-07-29 00:23:32.301041 |
User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
MEDIUM (5.3)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.
Published: 2026-07-09T07:55:11.676Z
Updated: 2026-07-09T14:08:28.882Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.