VulnSocial

CVE-2025-14047Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'Frontend_Form_Ajax::submit_post' function in all versions up to, and including, 4.2.4. This makes it possible for unauthenticated attackers to delete attachment.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-28: 1Technical Details · 2026-07-28: 107-28
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2025-14047 - medium 🚨 User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion > The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data ... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-14047 @pdnuclei...

    Post summary

    A new WordPress plugin vulnerability (CVE‑2025‑14047) is disclosed, enabling unauthenticated deletion of attachments, with no evidence of active exploitation, exploitable code, or available patches.

    00001281
    1.1K followersView on X

Explore more

Back to dashboard