Is CVE-2026-12406 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12406 being exploited in the wild.

How severe is CVE-2026-12406?

Medium severity, with a CVSS score of 5.3, published 9 July 2026.

Which products and versions are affected?

weDevs User Frontend up to, and including, 4.3.7.

Is there a fix for CVE-2026-12406?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12406 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12406?

Check whether you run weDevs User Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12406: wedevs User Frontend authorization bypass in wpuf_file_del AJAX action

CVE-2026-12406 · Severity: medium · CVSS 5.3 · Published 2026-07-09

The User Frontend plugin for WordPress, which manages user registrations and frontend postings, contains a security flaw that allows unauthorized file deletion. An unauthenticated visitor can delete media files uploaded by guests or through registration forms. This could lead to the loss of important user-submitted content and disrupt site operations.

Technologies: weDevs User Frontend. Vendors: weDevs.

Quick answers

Is CVE-2026-12406 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12406 being exploited in the wild.
How severe is CVE-2026-12406?: Medium severity, with a CVSS score of 5.3, published 9 July 2026.
Which products and versions are affected?: weDevs User Frontend up to, and including, 4.3.7.
Is there a fix for CVE-2026-12406?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12406 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12406?: Check whether you run weDevs User Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP User Frontend plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in the 'wpuf_file_del' AJAX action. The vulnerability exists in all versions up to and including 4.3.7. While the plugin uses a nonce for security, this nonce is localized into publicly accessible JavaScript objects ('wpuf_upload' and 'wpuf_frontend') whenever a plugin shortcode is rendered on a page. An unauthenticated attacker can use this leaked nonce to trigger the deletion of media attachments where the 'post_author' is 0, which typically includes guest uploads and registration form attachments. A patch appears to be available in the plugin's changeset repository.

Affected products

wedevs User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration up to, and including, 4.3.7

Timeline

2026-07-09: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.