PT-2026-25537

🗓️ 15 Mar 2026 00:00:00Reported by Positive TechnologiesType

Unauthenticated attackers can modify any post in The User Frontend plugin up to version 4.2.8 due to a missing capability check on draft post().

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-2233	15 Mar 202602:19	–	attackerkb
Circl	CVE-2026-2233	26 Mar 202614:47	–	circl
CNNVD	WordPress plugin User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration 安全漏洞	16 Mar 202600:00	–	cnnvd
CVE	CVE-2026-2233	15 Mar 202602:19	–	cve
Cvelist	CVE-2026-2233 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter	15 Mar 202602:19	–	cvelist
EUVD	EUVD-2026-12202	16 Mar 202615:30	–	euvd
NVD	CVE-2026-2233	16 Mar 202614:19	–	nvd
Patchstack	WordPress User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter vulnerability	16 Mar 202620:27	–	patchstack
RedhatCVE	CVE-2026-2233	26 Mar 202615:08	–	redhatcve
Vulnrichment	CVE-2026-2233 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter	15 Mar 202602:19	–	vulnrichment

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-2233
plugins	www.plugins.trac.wordpress.org/changeset/3468395/wp-user-frontend
t	www.t.me/CVEtracker/47410
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e0a278a3-f229-4673-8b3e-5b68f383dcc7

16 Mar 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.00193