WP User Frontend < 3.6.9 - Missing Authorization via AJAX actions

Description

The WP User Frontend plugin for WordPress is vulnerable to unauthorized functionality use due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to install some plugins, delete user packages, list taxonomies, dismiss promotional offers, and review notices, and preview forms.