CVE-2026-14567
Deferred Deferred - Pending Action

Unauthenticated User Data Exposure in User Frontend WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: WPScan

Description
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-14567
EUVD
EUVD-2026-67568

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_user_frontend wp_user_frontend to 4.3.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP User Frontend WordPress plugin before version 4.3.10. It allows unauthenticated attackers to access a user directory search endpoint and retrieve sensitive information, including email addresses and phone numbers of all registered users, such as administrators.

Detection Guidance

Check if your WP User Frontend plugin version is below 4.3.10. You can do this by inspecting the plugin files or using WordPress admin panel. Test the user directory search endpoint by attempting to access it without authentication and checking if it returns user email addresses or phone numbers.

Impact Analysis

Attackers can exploit this to obtain personal data of all users, including administrators, potentially leading to privacy breaches, identity theft, or targeted phishing attacks. Unauthorized access to admin contact details could also facilitate further attacks on the WordPress site.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access and exposure of personal data. It may also breach HIPAA if user data includes protected health information. Organizations must address this to avoid legal penalties and reputational damage.

Mitigation Strategies

Immediately update the WP User Frontend plugin to version 4.3.10 or later. If updating is not possible, consider disabling the plugin temporarily until the update is applied. Review user data exposure and notify affected users if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart