The User Frontend plugin for WordPress (wedevs) contains a missing capability check within the draft_post() function in all releases up to version 4.2.8. Due to this omission, any user, including those not authenticated, can send requests that alter posts by specifying a post_id value. This allows attackers to change post content, unpublish posts, or overwrite existing data. The flaw is categorized as CWE‑862, representing a missing authorization weakness.

All installations of the WordPress plugin "User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration" from wedevs that run version 4.2.8 or earlier are affected. No specific fixed version is mentioned in the CVE data, so any deployment of these or older versions is considered vulnerable.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only to craft an HTTP request containing a valid post_id parameter and submit it to the plugin’s draft_post endpoint; no authentication is required. While the likelihood of exploitation appears low, the potential impact of content tampering or removal warrants immediate attention.