https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 23:37:17 +0000 https://cve.radiocsirt.org/vuln/cve-2026-12406 <p><strong>Affected:</strong> wedevs User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership &amp; User Registration</p> <p>The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership &amp; User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.</p> <p><strong>Affected:</strong> wedevs User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership &amp; User Registration</p> <p>The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership &amp; User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.</p> https://cve.radiocsirt.org/vuln/cve-2026-12406