Vulnerability · Published Mar 15, 2026 · Assigned by Wordfence
CVE-2026-2233User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
Medium 5.3
In plain English
A medium-severity missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration from wedevs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wedevs | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration | 0 – through 4.2.8 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N