CVE-2026-14567 Overview
CVE-2026-14567 is an information disclosure vulnerability in the User Frontend WordPress plugin before version 4.3.10. The plugin fails to restrict access to its user directory search endpoint. Unauthenticated attackers can query the endpoint to retrieve the email address and phone number of every registered user, including administrators. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires no authentication, no user interaction, and can be performed remotely over the network.
Critical Impact
Unauthenticated remote attackers can harvest personally identifiable information (PII) for every registered user, enabling targeted phishing, credential stuffing, and social engineering against administrator accounts.
Affected Products
- User Frontend WordPress plugin versions prior to 4.3.10
- WordPress sites using the plugin's user directory search endpoint
- Any site exposing the affected endpoint to unauthenticated visitors
Discovery Timeline
- 2026-08-28 - CVE-2026-14567 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-14567
Vulnerability Analysis
The User Frontend plugin exposes a user directory search endpoint intended for authenticated site members. The endpoint returns records containing user email addresses and phone numbers. The plugin does not validate the requester's authentication state or permissions before returning results. As a result, any anonymous HTTP client can enumerate the full user base.
The issue is a Missing Authorization flaw combined with over-permissive data exposure. The endpoint should limit returned fields and enforce a capability check before responding. Both controls are absent in versions prior to 4.3.10.
Root Cause
The root cause is missing access control on the user directory search endpoint. The plugin registers the endpoint without a permission callback that verifies the caller's identity. It also serializes sensitive user meta fields, including user_email and phone number, into the JSON response. There is no filter to strip PII fields for anonymous or low-privilege requesters.
Attack Vector
An attacker sends unauthenticated HTTP requests to the plugin's user directory search endpoint on a vulnerable WordPress site. The attacker iterates through the search parameters or paginated results to enumerate all registered users. The response contains the email address and phone number for each account, including the site administrator. The harvested data supports downstream phishing campaigns, password reset abuse, and account takeover attempts against administrator accounts. No credentials, tokens, or user interaction are required.
See the WPScan Vulnerability Report for endpoint details.
Detection Methods for CVE-2026-14567
Indicators of Compromise
- Repeated unauthenticated requests to the User Frontend plugin's user search or directory endpoint from a single IP or IP range.
- HTTP responses containing JSON payloads with user_email or phone number fields returned to unauthenticated sessions.
- Sudden increase in outbound phishing reports referencing site users shortly after enumeration activity.
- Access log entries traversing paginated page= or search= parameters against the plugin endpoint.
Detection Strategies
- Inspect web server access logs for anonymous requests to User Frontend REST or AJAX endpoints returning large response bodies.
- Deploy web application firewall (WAF) rules that flag unauthenticated requests to plugin endpoints returning user PII.
- Correlate spikes in unique query parameters against the endpoint with the absence of authentication cookies.
Monitoring Recommendations
- Alert on any HTTP 200 response from the User Frontend user search endpoint that lacks an authenticated session cookie.
- Track request-rate baselines for /wp-json/ and admin-ajax.php handlers exposed by the plugin.
- Monitor administrator inboxes and phone lines for phishing or vishing attempts following suspected enumeration.
How to Mitigate CVE-2026-14567
Immediate Actions Required
- Upgrade the User Frontend WordPress plugin to version 4.3.10 or later on all affected sites.
- Audit web server and plugin logs for prior unauthenticated access to the user directory search endpoint.
- Notify administrators and users whose email addresses or phone numbers may have been exposed.
- Rotate administrator credentials and enable multi-factor authentication (MFA) on all privileged accounts.
Patch Information
The vendor addressed the issue in User Frontend version 4.3.10 by restricting access to the user directory search endpoint. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the User Frontend plugin until the patched version can be installed.
- Block unauthenticated access to the plugin's user directory endpoint at the WAF or reverse proxy layer.
- Restrict the endpoint to authenticated sessions with an explicit capability check using a mu-plugin filter.
- Remove or hide phone number user meta fields until the update is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
