User Frontend WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Unauthenticated Post Modification

A vulnerability exists in the User Frontend WordPress plugin, specifically in the AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration features, in all versions through 4.3.7. The issue is an Insecure Direct Object Reference (IDOR) that allows unauthenticated users to manipulate the 'wpuf_files_data' parameter without proper validation. This exploitation enables attackers to overwrite the post title, content, and excerpt of any post on the site, including those written by administrators. The vulnerability can be exploited by accessing any WPUF post submission form, which is available to users without a WordPress role, as the wpuf_submit_post AJAX action only requires a nonce and lacks a capability check for the post-editing process.

Impact

Successful exploitation allows for unauthorized modification of post titles, content, and excerpts, potentially disrupting site management and content integrity, especially if posts authored by administrators are targeted.

Reproduction

To reproduce this vulnerability, an unauthenticated user must access a WPUF post submission form. This can be done without any WordPress role, as the form is available to the public. Once the form is accessed, the user can send a request through the wpuf_submit_post AJAX action, including the 'wpuf_files_data' parameter with crafted data to overwrite the desired fields of an arbitrary post.

Remediation

Users are advised to update the User Frontend WordPress plugin to version 4.3.8 or later, where this vulnerability has been patched.