Junglewise Threat Intelligence

CVE-2026-3477: PZ Frontend Manager missing authorization in pzfm_user_request_action_callback

CVE-2026-3477 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Executive brief

The PZ Frontend Manager plugin for WordPress, which allows site owners to manage users and content from the front-end of their website, contains a security flaw in its user management functions. This vulnerability allows any logged-in user, even those with the lowest level of access, to delete other users from the system, including site administrators. Such an attack could lead to significant operational disruption and loss of administrative control over the website.

Technical details

The PZ Frontend Manager plugin for WordPress is vulnerable to missing authorization and missing nonce verification in the pzfm_user_request_action_callback() function. This function is hooked via wp_ajax_pzfm_user_request_action and fails to perform capability checks before executing user management tasks. When the 'dataType' parameter is set to 'delete', the function calls wp_delete_user() on provided user IDs. An authenticated attacker with Subscriber-level permissions or higher can exploit this by sending a crafted AJAX request to delete any user on the site, including administrators. The vulnerability exists in all versions up to and including 1.0.6.

Affected products

  • projectzealous01 PZ Frontend Manager <= 1.0.6

Timeline

  • 2026-04-08: disclosed
  • 2026-04-08: advisory

References