The User Frontend plugin for WordPress is vulnerable to reference that lets an unauthenticated attacker overwrite the title, content, and excerpt of any post, including those created by administrators, by sending a crafted wpuf_files_data payload. Because the plugin does not validate this key, the attacker can bypass normal post‑editing checks, compromising the integrity of site content and enabling defacement or malicious injection. This flaw is classified as CWE‑639.

Vendors and products: Wedevs’ User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration plugin. Versions affected: all releases up to and including 4.3.7.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % shows a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Any visitor can invoke the wpuf_submit_post AJAX action with a valid nonce and supply a wpuf_files_data payload, as the action lacks capability checks, allowing the attacker to target arbitrary post IDs without authentication or privileged access.