PT-2026-1602 · WordPress · Wp Front User Submit

Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-13419

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Front User Submit plugin for WordPress versions up to and including 5.0.0

Description The plugin is susceptible to unauthorized data modification because of a missing capability check on the /wp-json/bfe/v1/revert API endpoint. This allows unauthenticated attackers to delete arbitrary media attachments. The affected API endpoint is /wp-json/bfe/v1/revert.

Recommendations Update the WP Front User Submit plugin to a version later than 5.0.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13419

Affected Products

Wp Front User Submit

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-13419 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3432207%40front-editor&new=3432207%40front-editor&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2008838582975320570 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/874b3448-df4c-49c4-bf4f-435cf48f6305?source=cve · Note