PT-2026-64849 · WordPress · Wp User Frontend

Kimsunghoon · CVE-2026-14568 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin versions prior to 4.3.8

Description An issue exists where the software fails to correctly verify ownership before deleting an attachment. This allows unauthenticated attackers to permanently delete author-less attachments, including guest uploads and installed placeholder media.

Recommendations Update User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin to version 4.3.8 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-14568

Affected Products

Wp User Frontend

References · 3

• 🔥 https://wpscan.com/vulnerability/dcbc2a0c-6fa6-4266-9292-0a1f3418da08 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-14568 · Security Note
• https://t.me/CVEtracker/61305 · Telegram Post