CVE-2024-1170

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion

8.2 High

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handle_deleted_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to delete arbitrary media files.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: Low

Exploit likelihood

0.73%Up 0.7 points since Mar 8, 2024

What each source reports

CVE List Score used 8.2

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion

Record: CVE-2024-1170
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2024-16938 8.2

Record: EUVD-2024-16938
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hfj2-23xp-72cr 8.2

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for...

Record: GHSA-hfj2-23xp-72cr
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-862
Updated: 2026-11-02

NVD 8.2

Record: CVE-2024-1170
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-862
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-1170 is a high vulnerability (CVSS 8.2) in Svenl77 Post Form – Registration Form – Profile Form For User Profiles – Frontend Content Forms For User Submissions (ugc), published March 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. No source names a fixed version.