IT SBIT Services
Schneeberger
DEEN
CVE tracker

User Frontend: Privilege escalation via post_content parameter

CVE-2026-120070High 8.8

← All vulnerabilities

Summary

User Frontend, a WordPress plugin for registration, membership and frontend post submission, is affected up to and including version 4.3.13. An authenticated user with Subscriber rights or higher can store a manipulated registration shortcode with the Editor role in a published post. The registration form is then shown publicly, and anyone who submits it can create an Editor account. If auto-login after registration is enabled, the new account is logged in immediately.

Affected

  • User Frontend (weDevs, WordPress plugin) up to and including 4.3.13

Fixed in

Unknown. A fix is probably included in a release after 4.3.13. Check the WordPress.org changelog for the exact version.

Workaround

  • Review posts and pages for [wpuf-registration] shortcodes, especially those with a role attribute, and remove any you did not create.
  • Check for unexpected Editor or other elevated accounts.
  • Disable the auto-login after registration setting if you do not need it.
  • Restrict open Subscriber self-registration where feasible.

Exploitation

  • Exploitation requires an account with Subscriber rights.
  • No exploitation in the wild is known.
  • No public proof of concept is known.
  • CISA KEV status is unknown.

Our recommendation

  • Update User Frontend to the newest release as soon as possible.
  • Until then, apply the workarounds above.
  • Check your posts for injected registration shortcodes and your user list for unknown Editor accounts.
  • Monitor new user registrations and role changes.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:21.

Original description (NVD)

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role="editor"]` shortcode into a published post, causing a live Editor-role registration form to be rendered publicly on the frontend that any visitor — or the attacker themselves — can submit to mint a WordPress Editor account with an immediately active privileged session when the default `autologin_after_registration` setting is enabled.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed