WordPress · Wp User Frontend · CVE-2026-12418
**Name of the Vulnerable Software and Affected Versions**
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.8
**Description**
An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key within the `wpuf files data` parameter. This allows unauthenticated attackers to overwrite the `post title`, `post content`, and `post excerpt` of any arbitrary post on the site, including those authored by administrators. Exploitation is possible through any WPUF post submission form because the `wpuf submit post` AJAX action is protected only by a nonce and lacks a capability check for the subsequent post-edit operation.
**Recommendations**
Update the plugin to version 4.3.8 or later.
Restrict access to WPUF post submission forms to minimize the risk of exploitation.