CVE-2026-12406

🗓️ 09 Jul 2026 07:55:11Reported by WordfenceType

Unauthenticated deletion of attachments via wpuf_file_del in WPUF up to 4.3.7

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2026-12406	9 Jul 202607:55	–	attackerkb
Cvelist	CVE-2026-12406 User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter	9 Jul 202607:55	–	cvelist
EUVD	EUVD-2026-42537	9 Jul 202609:30	–	euvd
NVD	CVE-2026-12406	9 Jul 202608:16	–	nvd
Positive Technologies	PT-2026-56712	9 Jul 202600:00	–	ptsecurity

Vulners

Node

wedevs user_frontend:_ai_powered_frontend_posting,_user_directory,_profile_builder,_membership_&_user_registrationRange≤4.3.7wordpress

[
  {
    "vendor": "wedevs",
    "product": "User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.3.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0049583a-0ad3-45e4-a29e-4b8c33d09857
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Frontend.php
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Ajax/Upload_Ajax.php
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Ajax/Upload_Ajax.php
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Ajax/Upload_Ajax.php
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Frontend.php
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Ajax/Upload_Ajax.php
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.2/includes/Ajax.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.7/includes/Ajax.php