Medium severity · published Mar 15, 2026
CVE-2026-2233
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration · wedevs
through 4.2.8 · source: vendor
Affected product
UF
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
wedevs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2233
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3468395/wp-user-frontend
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a278a3-f229-4673-8b3e-5b68f383dcc7?source=cve
More from User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
8.8
CVE-2026-5127
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection
8.8
CVE-2026-1565
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload
5.3
CVE-2025-14047
WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
4.3
CVE-2026-4058
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation