# CVE-2026-12418: wedevs WP User Frontend IDOR in wpuf_files_data

Source: https://junglewise.ai/threats/cve-2026-12418-wedevs-wp-user-frontend-idor-in-wpuf-files-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-12418 · Severity: medium · CVSS 5.3 · Published 2026-07-09

A vulnerability in the WP User Frontend plugin for WordPress allows unauthorized individuals to modify existing website content. By exploiting a flaw in how the plugin handles post submissions, an attacker can overwrite the titles and text of any post or page, including those created by administrators. This could lead to website defacement or the spread of misinformation.

Technologies: [weDevs WP User Frontend](https://junglewise.ai/threats/technologies/user-frontend). Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-12418 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12418 being exploited in the wild.

**How severe is CVE-2026-12418?** Medium severity, with a CVSS score of 5.3, published 9 July 2026.

**Which products and versions are affected?** weDevs WP User Frontend <= 4.3.7.

**Is there a fix for CVE-2026-12418?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12418 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12418?** Check whether you run weDevs WP User Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WP User Frontend plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'wpuf_files_data' parameter in versions up to and including 4.3.7. This vulnerability stems from missing validation on a user-controlled key within the 'wpuf_submit_post' AJAX action. Although the action is protected by a nonce, it lacks a capability check for the downstream post-edit operation. An unauthenticated attacker with access to any WPUF post submission form can exploit this to overwrite the post_title, post_content, and post_excerpt of arbitrary posts, including those authored by administrators.

## Affected products

- wedevs WP User Frontend <= 4.3.7

## Timeline

- 2026-07-09: disclosed
- 2026-07-09: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.1/includes/Ajax/Frontend_Form_Ajax.php](https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.1/includes/Ajax/Frontend_Form_Ajax.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.1/includes/Traits/FieldableTrait.php](https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.1/includes/Traits/FieldableTrait.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.1/includes/Traits/FieldableTrait.php](https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.1/includes/Traits/FieldableTrait.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.6/includes/Ajax/Frontend_Form_Ajax.php](https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.6/includes/Ajax/Frontend_Form_Ajax.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.6/includes/Traits/FieldableTrait.php](https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.6/includes/Traits/FieldableTrait.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.6/includes/Traits/FieldableTrait.php](https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.6/includes/Traits/FieldableTrait.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3578622%40wp-user-frontend&new=3578622%40wp-user-frontend](https://plugins.trac.wordpress.org/changeset?reponame=&old=3578622%40wp-user-frontend&new=3578622%40wp-user-frontend)

## Related threats

- [weDevs WP User Frontend broken access control](https://junglewise.ai/threats/cve-2026-52708-missing-authorization-vulnerability-in-wedevs-wp-user-frontend-wp)
- [weDevs WP User Frontend broken access control](https://junglewise.ai/threats/cve-2026-48884-missing-authorization-vulnerability-in-wedevs-wp-user-frontend-wp)
- [WP User Frontend arbitrary file deletion](https://junglewise.ai/threats/cve-2026-95525-subscriber-arbitrary-file-deletion-in-wp-user-frontend-4-3-11)
- [WP User Frontend authentication bypass](https://junglewise.ai/threats/cve-2026-95524-unauthenticated-bypass-vulnerability-in-wp-user-frontend-4-3-11)
- [WP User Frontend subscriber privilege bypass](https://junglewise.ai/threats/cve-2026-95523-subscriber-bypass-vulnerability-in-wp-user-frontend-4-3-11)