Description
The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bfe/v1/revert' REST API endpoint in all versions up to, and including, 5.0.0. This makes it possible for unauthenticated attackers to delete arbitrary media attachments.
Published: 2026-01-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated deletion of media attachments via a REST endpoint
Action: Apply patch
AI Analysis

Impact

The WP Front User Submit plugin contains a missing capability check on the '/wp-json/bfe/v1/revert' REST API endpoint that allows any unauthenticated attacker to delete arbitrary media attachments from the WordPress media library. This vulnerability can be used to remove important files, disrupt site functionality, or sabotage the website’s content integrity. The weakness is categorized as a missing authorization problem (CWE‑862).

Affected Systems

The vulnerability affects the Aharonyan Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress in all releases up to and including version 5.0.0. No other vendors or product variants are listed in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of less than 1% suggests a very low probability that the flaw will be actively exploited today. The vulnerability is not listed in the CISA KEV catalog. An attacker can target the flaw by sending a crafted request directly to the /wp-json/bfe/v1/revert endpoint without needing authentication, thereby triggering the deletion operation.

Generated by OpenCVE AI on April 21, 2026 at 16:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Guest posting/Frontend Posting/Front Editor – WP Front User Submit plugin to the latest available release, which incorporates an authorization check on the /wp-json/bfe/v1/revert endpoint.
  • If an immediate update is not possible, restrict access to the /wp-json/bfe/v1/revert endpoint for unauthenticated users by implementing a rewrite rule, using a WordPress security plugin, or configuring a web‑application firewall to deny DELETE requests from non‑logged‑in accounts.
  • Review the WordPress role configuration to ensure that only users with appropriate delete capabilities (e.g., administrators or editors) can delete media items, and remove any unnecessary delete permissions granted to lower‑privileged roles.

Generated by OpenCVE AI on April 21, 2026 at 16:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Jan 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Wed, 07 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Jan 2026 09:30:00 +0000

Type Values Removed Values Added
Description The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bfe/v1/revert' REST API endpoint in all versions up to, and including, 5.0.0. This makes it possible for unauthenticated attackers to delete arbitrary media attachments.
Title Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletion
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:05:06.354Z

Reserved: 2025-11-19T14:56:27.616Z

Link: CVE-2025-13419

cve-icon Vulnrichment

Updated: 2026-01-07T15:05:51.550Z

cve-icon NVD

Status : Deferred

Published: 2026-01-07T12:16:47.880

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-13419

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T16:45:15Z

Weaknesses