The User Frontend (Wedevs) plugin for WordPress has an authorization bypass in its wpuf_file_del AJAX action. The check that verifies the requesting user has permission to delete an attachment is missing, and the required nonce is exposed in public JavaScript on any page that displays the WPUF shortcode. As a result, an unauthenticated visitor can send a crafted request to wp-admin/admin-ajax.php?action=wpuf_file_del with an attach_id and the publicly disclosed nonce, causing the plugin to delete the specified media attachment that belongs to the guest author (post_author = 0). This flaw allows arbitrary deletion of media files, compromising data integrity and availability for sites that accept guest uploads or use the plugin for user profiles.

All installations of the Wedevs User Frontend plugin up to and including version 4.3.7 are affected. WordPress sites that have the plugin active on the front end – particularly those rendering the WPUF shortcode or exposing the `wpuf_file_del` AJAX action publicly – are vulnerable. The vulnerability is specific to attachments uploaded by the author with the ID 0 (the ‘guest’ author), which are commonly used for registration forms or profile images.

The CVSS score of 5.3 classifies the issue as moderate, primarily due to the loss of data integrity and availability. The EPSS score of less than 1 % indicates that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack requires no authentication; a simple HTTP POST request to `/wp-admin/admin-ajax.php` with the action `wpuf_file_del`, the target `attach_id`, and the nonce obtained from the frontend JavaScript is sufficient to delete the media file. This makes the vulnerability trivially exploitable on any public page that loads the plugin’s JavaScript.