CVE-2026-14567

MEDIUM CVSS 5.3 View on NVD ↗

Description

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/1ff904bd-cb9e-4530-afb4-6842395bb774/

Published: Aug 28, 2026 08:16 UTC Modified: Aug 28, 2026 18:40 UTC