CVE-2026-12406

Name of the Vulnerable Software and Affected Versions User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.8

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can delete arbitrary media attachments where the post author is 0, including guest and registration-form uploads, by utilizing the wpuf file del AJAX action. This is possible on sites where a WPUF shortcode is rendered on a front-end page, as the wpuf nonce value is localized into publicly accessible JavaScript objects (wpuf upload and wpuf frontend), bypassing the access control mechanism.

Recommendations Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to version 4.3.8 or later.