PT-2026-31093 · Projectzealous01 · Pz Frontend Manager

Youcef Hamdani

·

Published

2026-04-08

·

Updated

2026-04-08

·

CVE-2026-3477

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6. The pzfm user request action callback() function, registered via the wp ajax pzfm user request action action hook, lacks both capability checks and nonce verification. This function handles user activation, deactivation, and deletion operations. When the 'dataType' parameter is set to 'delete', the function calls wp delete user() on all provided user IDs without verifying that the current user has the appropriate permissions. Notably, the similar pzfm remove item callback() function does check pzfm can delete user() before performing deletions, indicating this was an oversight. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary WordPress users (including administrators) by sending a crafted request to the AJAX endpoint.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3477

Affected Products

Pz Frontend Manager