Medium severity · published Aug 28, 2026
CVE-2026-14567
WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
User Frontend ·
4.3.0 before 4.3.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14567
wpscan.com
https://wpscan.com/vulnerability/1ff904bd-cb9e-4530-afb4-6842395bb774/
More from User Frontend
8.8
CVE-2026-19116
WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
7.4
CVE-2026-75823
WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
7.2
CVE-2026-14558
WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
5.3
CVE-2026-75824
WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
5.3
CVE-2026-17563
WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form