CVE-2026-12406: User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose postauthor is 0, such as guest and registration-form uploads, via the wpuffiledel AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpufnonce value to be localized into publicly accessible JavaScript objects (wpufupload and wpuffrontend), satisfying the sole access control gate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: The User Frontend (AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration)to a version that resolves this vulnerability.Fixed in 4.3.7 - Compensating control
If you cannot patch immediately, prevent public exposure of the WPUF localized JavaScript objects (wpuf_upload and wpuf_frontend) by removing/disabling front-end pages where the WPUF shortcode is rendered, so unauthenticated visitors cannot satisfy the wpuf_nonce access control gate for the wpuf_file_del AJAX action.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12406?
CVE-2026-12406 has a medium severity score of 5.3.
How does CVE-2026-12406 impact WordPress users?
CVE-2026-12406 allows unauthenticated users to delete arbitrary attachments due to a missing authorization check.
Which versions of the User Frontend plugin are affected by CVE-2026-12406?
CVE-2026-12406 affects all versions of the User Frontend plugin up to and including 4.3.7.
How can I fix CVE-2026-12406?
To fix CVE-2026-12406, update the User Frontend plugin to a version later than 4.3.7.
What actions should I take if I have CVE-2026-12406 on my site?
If CVE-2026-12406 is present on your site, ensure you update the User Frontend plugin and review any unauthorized changes made.