Description

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T08:16:40.423Z",
  "pubdate": "2026-08-28T08:16:40.423Z",
  "executiveSummary": "The User Frontend WordPress plugin, specifically versions prior to 4.3.10, contains a critical information disclosure vulnerability. The flaw originates from an improperly secured user directory search endpoint that fails to enforce authentication or authorization controls.\nThis vulnerability enables unauthenticated remote attackers to perform unauthorized queries against the WordPress user database. Successful exploitation results in the bulk exfiltration of sensitive user metadata, including registered email addresses and phone numbers for all users, regardless of their privilege level (including administrative accounts).\nThe risk implication is high, as the leaked data facilitates downstream attacks, such as targeted phishing, social engineering, or brute-force attempts against administrative accounts. Because the endpoint is publicly accessible, the attack surface is exposed to any network entity capable of communicating with the target WordPress instance. No user interaction or prior credentials are required to exploit this deficiency, representing a significant breach of data privacy and organizational security.",
  "technicalDetails": "The vulnerability resides within the user directory search functionality of the User Frontend plugin, which functions as an exposed API endpoint intended for front-end directory rendering. The root cause is an insufficient access control check (Insecure Direct Object Reference or missing authentication gate) on the search controller responsible for processing directory queries.\nUnder normal operating conditions, this endpoint is intended to facilitate user searches for front-end interface features. However, the implementation does not validate the request context, allowing the application to process queries from unauthenticated remote users. By sending a crafted GET or POST request to the plugin's search endpoint, an attacker can bypass the intended access limitations.\nThe attack flow proceeds as follows: First, the attacker identifies the specific URL pattern associated with the User Frontend search function. Second, the attacker sends a request to this endpoint, often iterating through parameters that define the search scope or page limits. Because the backend code lacks a check for session tokens, capabilities (such as 'manage_options' or 'list_users'), or nonces, the application backend queries the 'wp_users' table and associated user meta fields.\nThe plugin subsequently serializes the retrieved user objects—including sensitive fields such as 'user_email' and custom meta fields storing 'phone_number'—and returns them in the HTTP response body, typically in JSON format. An attacker can systematically harvest the entire user directory by manipulating pagination or search parameters in successive requests.\nAffected versions include all iterations of User Frontend prior to 4.3.10. The exposure is total, meaning that administrative, editor, and subscriber account information is exposed equally. Post-exploitation impact involves the acquisition of high-value personally identifiable information (PII). This data is often utilized by threat actors to craft credible spear-phishing lures directed at WordPress administrators, or to supplement databases for credential stuffing attacks against the authentication interface of the WordPress installation.\nThe vulnerability is categorized as a failure to implement proper authorization, as the endpoint treats anonymous requests with the same processing priority as authorized administrative requests, effectively acting as an unauthenticated information leakage vector."
}