Executive brief
WP User Frontend is a popular WordPress plugin for managing user-submitted content and profiles. Versions before 4.3.10 expose the email addresses and phone numbers of all registered WordPress users, including administrators, to unauthenticated visitors through an unprotected API endpoint. This information can be harvested in bulk and used for targeted phishing, spam campaigns, or social engineering attacks.
Technical details
The plugin's REST API endpoint `/wp-json/wpuf/v1/user_directory/search` does not enforce authentication or authorization checks, allowing unauthenticated attackers to query and retrieve sensitive user data. The vulnerability stems from missing access controls on the user directory search functionality; attackers can omit required parameters (such as directory_id) to bypass directory publication guards and access all user records. The endpoint returns email addresses and phone numbers in the response for every registered user. No authentication credentials, cookies, or CSRF tokens are required. The issue is fixed in version 4.3.10.
Affected products
- WP User Frontend WP User Frontend before 4.3.10
Timeline
- 2026-08-26: disclosed
- 2026-08-28: advisory