{"id":"CVE-2026-14568","aliases":["EUVD-2026-49082","GHSA-p8fm-59wc-5xxj"],"status":"published","title":"WP User Frontend \u003c 4.3.8 - Unauthenticated Author-less Attachment Deletion","description":"The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8-installed placeholder media.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00343,"percentile":0.28049,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-07-27T06:00:05Z","modified":"2026-07-27T20:33:01Z","products":[{"vendor":"unknown","product":"user frontend: ai powered frontend post submission, user directory, user profile, membership \u0026 user registration"}],"references":[{"url":"https://wpscan.com/vulnerability/dcbc2a0c-6fa6-4266-9292-0a1f3418da08/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14568"},{"url":"https://wpscan.com/vulnerability/dcbc2a0c-6fa6-4266-9292-0a1f3418da08"},{"url":"https://github.com/advisories/GHSA-p8fm-59wc-5xxj"}],"sources":{"cve":[{"id":"CVE-2026-14568","title":"WP User Frontend \u003c 4.3.8 - Unauthenticated Author-less Attachment Deletion","description":"The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8-installed placeholder media.","status":"published","published":"2026-07-27T06:00:05.425Z","modified":"2026-07-27T17:35:40.456Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-49082","description":"The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8-installed placeholder media.","status":"published","published":"2026-07-27T06:00:05Z","modified":"2026-07-27T17:35:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:02:33.886037Z"}],"ghsa":[{"id":"GHSA-p8fm-59wc-5xxj","title":"The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership ...","description":"The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8-installed placeholder media.","status":"published","published":"2026-07-27T09:31:26Z","modified":"2026-07-27T18:31:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:51.407039Z"}],"nvd":[{"id":"CVE-2026-14568","description":"The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership \u0026 User Registration WordPress plugin before 4.3.8-installed placeholder media.","status":"published","published":"2026-07-27T07:16:25.987Z","modified":"2026-07-27T20:33:01.673Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:32.830533Z"}]}}