CVE-2026-14567: WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
Published Aug 28, 2026
·Updated
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
Affected Software
1 affected component
WP User Frontend<4.3.10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP User Frontendto a version that resolves this vulnerability.Fixed in 4.3.10
Event History
Aug 28, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated remote attacker can query the user directory search endpoint. No account or elevated privileges are required.
2
What information can be exposed?
The endpoint can disclose the email address and phone number of every registered user, including administrator accounts.
3
Which installations are affected?
WP User Frontend versions earlier than 4.3.10 are affected.