{"id":"CVE-2026-120070","kind":"vulnerability","aliases":["CVE-2026-120070"],"related":[],"title":"User Frontend WordPress plugin: subscribers can mint editor accounts via shortcode","description":"The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role=\"editor\"]` shortcode into a published post, causing a live Editor-role registration form to be rendered publicly on the frontend that any visitor — or the attacker themselves — can submit to mint a WordPress Editor account with an immediately active privileged session when the default `autologin_after_registration` setting is enabled.","summary":"The User Frontend WordPress plugin up to and including 4.3.13 lets a logged-in Subscriber store a registration shortcode in a published post by hiding a control byte in its tag name, which bypasses the plugin's blocklist check. Any visitor can then submit the resulting public form to create an Editor-role account, and when autologin after registration is enabled, that account is logged in immediately.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","user-frontend","wordpress","wordpress-plugin"],"not_affected_if":["autologin-disabled","plugin-not-installed"],"how_to_check":"- Check the User Frontend plugin version in the WordPress admin Plugins screen; versions up to and including `4.3.13` are affected.\n- Check whether `autologin_after_registration` is enabled in the plugin's settings.\n- Search published posts for `[wpuf-registration` with `role=\"editor\"` in the content.","fix":null,"status":"open","published_at":"2026-10-31T08:16:49+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","triaged_at":"2026-10-31T08:35:09+00:00","updated_at":"2026-10-31T08:35:09+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-31T08:35:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"User Frontend WordPress plugin: subscribers can mint editor accounts via shortcode","impact":"high","summary":"The User Frontend WordPress plugin up to and including 4.3.13 lets a logged-in Subscriber store a registration shortcode in a published post by hiding a control byte in its tag name, which bypasses the plugin's blocklist check. Any visitor can then submit the resulting public form to create an Editor-role account, and when autologin after registration is enabled, that account is logged in immediately.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wordpress-plugin","user-frontend"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gets an active Editor-role account on the WordPress site","analyst_note":"","how_to_check":"- Check the User Frontend plugin version in the WordPress admin Plugins screen; versions up to and including `4.3.13` are affected.\n- Check whether `autologin_after_registration` is enabled in the plugin's settings.\n- Search published posts for `[wpuf-registration` with `role=\"editor\"` in the content.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","autologin-disabled"],"who_is_affected":"Sites running the User Frontend plugin up to and including 4.3.13 are exposed, and the attack only needs any Subscriber-level account on the site. The worst case the sources describe depends on autologin after registration being enabled, which is the default. Sites without the plugin, or with autologin disabled and no way for Subscribers to log in, are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001622,"input_tokens":4529,"output_tokens":2338,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120070':14A,17A '-2026':13A,16A '4.3.13':35B,126C 'access':258C 'account':9A,81B,90B,303C 'activ':307C 'actual':161C 'add':228C 'admin':235C,240C,245C 'admin-ajax':239C 'ajax':241C 'allow':181C 'attack':183C,253C,294C 'authent':252C 'autologin':84B,313C 'blocklist':64B,145C,201C 'bypass':60B 'byte':54B,180C,189C 'c0':178C 'caus':274C 'check':65B,202C 'clean':205C 'contain':223C 'content':105C,130C,157C 'control':53B,179C 'copi':152C,160C 'creat':76B 'cve':12A,15A 'databas':165C 'default':312C 'defeat':198C 'directori':104C 'editor':8A,79B,268C,278C,302C 'editor-rol':78B,277C 'either':219C 'enabl':88B,318C 'escal':118C 'exist':139C 'fals':237C 'field':151C 'form':74B,281C 'frontend':2A,21B,28B,97C,108C,222C,288C 'function':136C,206C 'guard':146C 'hide':51B 'immedi':94B,306C 'includ':34B,125C 'inject':185C,262C 'insid':190C 'inspect':147C 'instanti':232C 'kses':170C,173C 'let':36B 'level':257C 'live':276C 'log':39B,92B 'logged-in':38B 'make':248C 'membership':98C 'mint':7A,299C 'name':58B,196C 'neutral':215C 'null':175C 'paramet':131C 'persist':162C 'plugin':4A,25B,30B,62B,111C 'possibl':250C 'post':49B,109C,129C,135C,156C,273C 'privileg':117C,308C 'process':167C 'profil':102C 'protect':143C 'protected-shortcod':142C 'public':73B,285C 'publish':48B,272C 'regist':225C 'registr':44B,86B,100C,194C,266C,280C,315C 'render':284C 'request':242C 'restrict':106C 'result':72B 'role':80B,267C,279C 'sanit':149C 'session':309C 'set':316C 'shortcod':11A,45B,144C,207C,212C,218C,229C,269C 'singl':187C 'step':176C 'store':42B,209C,217C 'strip':177C,211C 'strpos':200C 'submiss':110C 'submit':70B,134C,155C,297C 'subscrib':5A,41B,256C 'subscriber-level':255C 'tag':57B,195C 'textarea':150C 'true':246C 'user':1A,20B,27B,96C,99C,101C,103C 'user-frontend':19B 'verbatim':210C 'version':121C 'via':10A,127C,227C 'visitor':67B,291C 'vulner':115C,138C 'whose':171C 'wordpress':3A,22B,24B,29B,113C,301C 'wordpress-plugin':23B 'wp':169C,172C 'wpuf':193C,265C 'wpuf-registr':192C,264C 'x01':188C","nicknames":[],"mitigations":[],"who_affected":"Sites running the User Frontend plugin up to and including 4.3.13 are exposed, and the attack only needs any Subscriber-level account on the site. The worst case the sources describe depends on autologin after registration being enabled, which is the default. Sites without the plugin, or with autologin disabled and no way for Subscribers to log in, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T08:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120070","severity":null,"published_at":"2026-10-31T08:16:49+00:00","modified_at":"2026-10-31T08:16:49+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","fetched_at":"2026-10-31T08:34:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}