CyberRota Analysis
AI-GeneratedThe User Frontend plugin for WordPress is vulnerable to an authorization bypass, allowing unauthenticated attackers to delete arbitrary media attachments associated with guest uploads. This flaw affects all versions up to 4.3.7 and can be exploited on any site using the plugin's shortcode on front-end pages, as it exposes valid nonce values in publicly accessible JavaScript. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of unauthorized media deletion.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.