CVE-2026-12418

MediumCVSS 5.3/10Last modified Jul 9, 2026

Description

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as the wpuf_submit_post AJAX action is gated only by a nonce with no capability check for the downstream post-edit operation.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
wedevsUser Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration<= 4.3.7

References

Timeline

Published
Jul 9, 2026
Last modified
Jul 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1241836.5Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-1241857.5Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1241878.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1241946.5Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a netwoCVE-2026-12424.3The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions CVE-2026-124217.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and includiCVE-2026-1242106.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-1242247.0Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locCVE-2026-1242257.8Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.CVE-2026-1242268.8Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.CVE-2026-1242277.5Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1242288.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to