CVE-2026-14568 | The User Frontend: AI Powered Frontend Post Submission, User…

Description

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.

Metadata

CVE ID: CVE-2026-14568
State: PUBLISHED
Assigner: WPScan
Reserved: 2026-07-03 10:19 UTC
Published: 2026-07-27 06:00 UTC
Last updated: 2026-07-27 06:00 UTC
Vendor / Product: Unknown / User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Unknown	User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration	—	0 < 4.3.8

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-287 Improper Authentication

References (1)

https://wpscan.com/vulnerability/dcbc2a0c-6fa6-4266-9292-0a1f3418da08/