What is GHSA-vwp5-qxw4-4vgw?

GHSA-vwp5-qxw4-4vgw is a security advisory published by GitHub Security Advisories with Medium severity. The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory...

Which CVE IDs does GHSA-vwp5-qxw4-4vgw cover?

GHSA-vwp5-qxw4-4vgw covers the following CVE IDs: CVE-2026-14567. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vwp5-qxw4-4vgw?

GHSA-vwp5-qxw4-4vgw has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-vwp5-qxw4-4vgwMediumCVSS 5.3

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-14567 →

📋 Description

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14567
https://wpscan.com/vulnerability/1ff904bd-cb9e-4530-afb4-6842395bb774
https://github.com/advisories/GHSA-vwp5-qxw4-4vgw