CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
Explanation of Vulnerability in Simple Terms
User Frontend contains a missing authorization check that allows unauthenticated attackers to modify data on the site. The vulnerability affects all versions up to 4.2.8. An attacker can send a network request without authentication to trigger the flaw. Site administrators should update to a version newer than 4.2.8 as soon as it becomes available.
What an attacker can do
Modify site data without logging in or having any account.
Potential impact on your site
Unauthorized users can alter content, user profiles, or registration data on your site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
