CVE-2026-14567: falha de média gravidade em User Frontend
WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.3%
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Unknown · User FrontendPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/1ff904bd-cb9e-4530-afb4-6842395bb774/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — User Frontend
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14558HIGHWP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form BuilderEPSS 0.8%CVE-2026-19116HIGHWP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit FormEPSS 0.7%CVE-2026-17563MEDIUMWP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated FormEPSS 0.3%CVE-2026-75823HIGHWP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role EncryptionEPSS 0.3%CVE-2026-75824MEDIUMWP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration DisabledEPSS 0.2%CVE-2026-115277MEDIUMWP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' ParameterEPSS 0.2%