PT-2026-56713 · Wedevs · User Frontend: Ai Powered Frontend Posting
Kim Chanyeop
·
Publicado
2026-07-09
·
Atualizado
2026-07-09
·
CVE-2026-12418
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf files data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post title, post content, and post excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as the wpuf submit post AJAX action is gated only by a nonce with no capability check for the downstream post-edit operation.
Correção
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
User Frontend: Ai Powered Frontend Posting