The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wp User Frontend Plugin | — | Update wp-user-frontend plugin to version 4.2.9, or a newer patched version | May 4, 2026 | Mar 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub