Junglewise Threat Intelligence

CVE-2026-12406: wedevs User Frontend authorization bypass in wpuf_file_del AJAX action

CVE-2026-12406 · Severity: medium · CVSS 5.3 · Published 2026-07-09

Technologies: weDevs User Frontend. Vendors: weDevs.

Executive brief

The User Frontend plugin for WordPress, which manages user registrations and frontend postings, contains a security flaw that allows unauthorized file deletion. An unauthenticated visitor can delete media files uploaded by guests or through registration forms. This could lead to the loss of important user-submitted content and disrupt site operations.

Technical details

The WP User Frontend plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in the 'wpuf_file_del' AJAX action. The vulnerability exists in all versions up to and including 4.3.7. While the plugin uses a nonce for security, this nonce is localized into publicly accessible JavaScript objects ('wpuf_upload' and 'wpuf_frontend') whenever a plugin shortcode is rendered on a page. An unauthenticated attacker can use this leaked nonce to trigger the deletion of media attachments where the 'post_author' is 0, which typically includes guest uploads and registration form attachments. A patch appears to be available in the plugin's changeset repository.

Affected products

  • wedevs User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration up to, and including, 4.3.7

Timeline

  • 2026-07-09: advisory: NVD publication date

References