PT-2026-25537 · Wedevs · User Frontend: Ai Powered Frontend Posting

Supakiad S · Published 2026-03-15 · Updated 2026-03-16 · CVE-2026-2233

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.2.9

Description The User Frontend plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the draft post() function allows unauthenticated attackers to modify arbitrary posts. This can include actions like unpublishing published posts and overwriting content. The modification is achieved through manipulation of the post id parameter.

Recommendations Update User Frontend to version 4.2.9 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2233

Affected Products

User Frontend: Ai Powered Frontend Posting

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-2233 · Security Note
• https://plugins.trac.wordpress.org/changeset/3468395/wp-user-frontend · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e0a278a3-f229-4673-8b3e-5b68f383dcc7?source=cve · Note
• https://t.me/CVEtracker/47410 · Telegram Post