PT-2026-25537 · Wedevs · User Frontend: Ai Powered Frontend Posting

Supakiad S · Publicado 2026-03-15 · Atualizado 2026-03-16 · CVE-2026-2233

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.2.9

Description The User Frontend plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the draft post() function allows unauthenticated attackers to modify arbitrary posts. This can include actions like unpublishing published posts and overwriting content. The modification is achieved through manipulation of the post id parameter.

Recommendations Update User Frontend to version 4.2.9 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2233

Produtos afetados

User Frontend: Ai Powered Frontend Posting

Referências · 4

• https://plugins.trac.wordpress.org/changeset/3468395/wp-user-frontend · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/e0a278a3-f229-4673-8b3e-5b68f383dcc7?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2233 · Nota de Segurança
• https://t.me/CVEtracker/47410 · Publicação no Telegram