Logo
Retour à la veille

CVE-2026-12406

Publié : 9 juillet 2026
Modifié : 9 juillet 2026
Lien officiel NVD
Score CVSS
5.3
MEDIUM

Description détaillée

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Ajax.php#L27https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Ajax/Upload_Ajax.php#L257https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Ajax/Upload_Ajax.php#L271https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Frontend.php#L88https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Ajax.php#L27https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Ajax/Upload_Ajax.php#L257https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Ajax/Upload_Ajax.php#L271https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Frontend.php#L88https://plugins.trac.wordpress.org/changeset?reponame=&old=3578622%40wp-user-frontend&new=3578622%40wp-user-frontendhttps://www.wordfence.com/threat-intel/vulnerabilities/id/0049583a-0ad3-45e4-a29e-4b8c33d09857?source=cve

Dernières Vulnérabilités

CVE-2026-15184

A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.

VOIR DÉTAILS

CVE-2026-9253

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

VOIR DÉTAILS

CVE-2026-15182

A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component.

VOIR DÉTAILS