CVE-2026-120070
Received Received - Intake

Privilege Escalation in User Frontend WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role="editor"]` shortcode into a published post, causing a live Editor-role registration form to be rendered publicly on the frontend that any visitor — or the attacker themselves — can submit to mint a WordPress Editor account with an immediately active privileged session when the default `autologin_after_registration` setting is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-120070
EUVD
EUVD-2026-114657

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows authenticated users with Subscriber-level access or higher to escalate privileges to Editor by injecting a malicious shortcode into a published post. The flaw exists because the plugin checks a sanitized version of user input but stores a different version that bypasses security checks. An attacker can add a specific control character to a shortcode, which is then stored and rendered as a functional Editor registration form. When the default auto-login setting is enabled, submitting this form creates an active Editor account for the attacker or any visitor.

Detection Guidance

Check WordPress sites for the User Frontend plugin versions up to 4.3.13. Inspect posts for modified shortcodes like [wpuf-registration role="editor"] in published content. Review user roles and recent Editor account creations. Use commands like grep -r "wpuf-registration" /path/to/wordpress or check plugin version via wp plugin list in WP-CLI.

Impact Analysis

If you use this WordPress plugin, an attacker could gain unauthorized Editor-level access to your site. This allows them to create, edit, or delete posts and pages, modify site settings, and potentially take full control of your WordPress installation. The attack requires only a Subscriber account and can be executed remotely without admin privileges.

Mitigation Strategies

Update the User Frontend plugin to the latest version beyond 4.3.13 immediately. Disable the plugin if updates are unavailable. Review and remove any unauthorized Editor-role registration forms. Audit user accounts for unexpected elevated roles. Disable autologin_after_registration if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart