User Frontend WordPress Plugin Authorization Bypass Vulnerability Allowing Unauthenticated Attachment Deletion

A vulnerability exists in the User Frontend WordPress plugin, specifically in versions through 4.3.7. The issue arises from the plugin's failure to properly verify user authorization, allowing unauthenticated users to delete arbitrary media attachments with a post author of 0. This includes files uploaded by guests or through registration forms. The vulnerability is exploited via the 'wpuf_file_del' AJAX action, on sites where a WPUF shortcode is active on the front end. This configuration exposes a valid nonce, bypassing the only access control in place.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of media attachments, potentially disrupting user-uploaded content such as images or files submitted through registration forms.

Reproduction

To reproduce this vulnerability, upload a file as a guest or through a registration form on a WordPress site with the User Frontend plugin version 4.3.7 or earlier. Ensure that a WPUF shortcode is active on the front end, which will localize a valid nonce into publicly accessible JavaScript objects. An unauthenticated user can then send a request to the 'wpuf_file_del' AJAX action, including the 'attach_id' of the file to be deleted. This request will bypass authorization checks and result in the specified attachment being deleted.

Remediation

Users are advised to update the User Frontend plugin to version 4.3.8 or later, where this vulnerability has been patched.