WP User Frontend Missing Capability Check Allows Unauthenticated Attachment Deletion Vulnerability

A vulnerability exists in the WP User Frontend plugin for WordPress, specifically in versions through 4.2.4. The issue arises from a missing capability check in the 'submit_post' function, which allows unauthenticated users to delete attachments. This unauthorized data loss is facilitated by the plugin's handling of AJAX requests, where the absence of proper authorization checks enables the exploitation of attachment deletion features.

Impact

Exploitation of this vulnerability leads to unauthorized deletion of attachments.

Reproduction

To reproduce this vulnerability, send a request to the 'wpuf_submit_post' AJAX action without authentication. Include the 'delete_attachments' parameter with the IDs of the attachments to be deleted. The request will bypass authorization checks and delete the specified attachments.

Remediation

Users are advised to update the WP User Frontend plugin to version 4.2.5 or later, where this vulnerability has been patched.