CVE-2026-2233

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-223308.1Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.CVE-2026-223318.1Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.CVE-2026-223329.3Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.CVE-2026-223337.2Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This i CVE-2026-223347.5Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.CVE-2026-223358.5Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.CVE-2026-223369.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injecti CVE-2026-223379.8Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Director CVE-2026-223388.1Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.CVE-2026-223397.1Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.CVE-2026-22349.1C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any use CVE-2026-223409.3Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions.