UNKNOWN NVD

CVE-2026-14567

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.

References

https://wpscan.com/vulnerability/1ff904bd-cb9e-4530-afb4-6842395bb774/

Published: 2026-08-28 · Source: NVD · Feed updated: 2026-08-28

This unknown severity vulnerability was published on 2026-08-28 via NVD.

vulnfeed aggregates 11380 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.