The User Frontend plugin for WordPress suffers from an insecure direct object reference that allows an unauthenticated user to modify any post’s title, content, and excerpt by supplying a crafted wpuf_files_data payload. Because the plugin fails to validate this key, the attacker can bypass normal post‑editing checks and overwrite data belonging to any post, including those authored by administrators. This capability constitutes a breach of content integrity, enabling defacement and the injection of malicious or phishing material.

The affected product is the Wedevs User Frontend suite, which bundles AI powered posting, user directories, profile building, membership, and registration functionality, running on WordPress. All releases up to and including version 4.3.7 are impacted. Site owners using such versions should consider the plugin version and any existing compatibility constraints.

The CVSS base score of 5.3 places this flaw in the moderate range, while the EPSS score of less than 1% suggests a low current exploitation probability. It is not listed in CISA KEV. The vulnerability is exploitable through the wpuf_submit_post AJAX action, which only requires a valid nonce and no capability checks, allowing anyone who can reach the endpoint to send a payload that triggers the insecure data handling. An attacker needs only network access to the site but no user credentials.