CVE-2024-8427mediumCWE-862

CVE-2024-8427: medium-severity vulnerability in wpshuffle Frontend Post Submission Manager…

Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

Published · Updated

Follow this CVE+ Monitor Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.3%
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
wpshuffle · Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin
Related CVEs — wpshuffle Frontend Post Submission Manager…

In the same product, most dangerous first.

CVE-2026-1296MEDIUMFrontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' ParameterEPSS 0.5%CVE-2025-14913MEDIUMFrontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment DeletionEPSS 0.3%CVE-2025-14080MEDIUMFrontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post ModificationEPSS 0.3%