CVE-2026-14568
WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.
| Vendor | unknown |
| Product | user frontend: ai powered frontend post submission, user directory, user profile, membership & user registration |
| Published | Jul 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown user frontend: ai powered frontend post submission, user directory, user profile, membership & user registration
Be the first to know when new unknown vulnerabilities affecting unknown user frontend: ai powered frontend post submission, user directory, user profile, membership & user registration are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
0 < 4.3.8
References
Credits
kimsunghoon WPScan