CVE-2026-12418

Name of the Vulnerable Software and Affected Versions User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.8

Description An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key within the wpuf files data parameter. This allows unauthenticated attackers to overwrite the post title, post content, and post excerpt of any arbitrary post on the site, including those authored by administrators. Exploitation is possible through any WPUF post submission form because the wpuf submit post AJAX action is protected only by a nonce and lacks a capability check for the subsequent post-edit operation.

Recommendations Update the plugin to version 4.3.8 or later. Restrict access to WPUF post submission forms to minimize the risk of exploitation.