Skip to content
Sign in
5.3 Medium

CVE-2025-13419 The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to…

Description

The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bfe/v1/revert' REST API endpoint in all versions up to, and including, 5.0.0. This makes it possible for unauthenticated attackers to delete arbitrary media attachments.

Affected products and versions

Product Affected versions Fixed in
Guest posting / Frontend Posting / Front Editor – WP Front User Submit 5.0 earliest → 5.0.0 No fix stated

Other CVEs of Guest posting / Frontend Posting / Front Editor – WP Front User Submit

The 3 CVEs of Guest posting / Frontend Posting / Front Editor – WP Front User Submit →
CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… 6.3 Medium CVE-2024-2967 The Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin for WordPress is… 4.4 Medium
Track this CVE