CVE-2026-120070: Privilege Escalation in User Frontend

Privilege escalation in User Frontend: Subscribers inject shortcodes to create Editor accounts. CVSS 8.8.

CVE-2026-120070 is a privilege escalation vulnerability in the User Frontend plugin for WordPress. The flaw exploits a bypass in the shortcode protection blocklist: attackers authenticated with Subscriber-level access can inject [wpuf-registration] shortcodes with role="editor" attribute into published posts, bypassing sanitization checks. The bypass mechanism uses C0 control bytes to avoid the strpos() check on the blocklist, allowing the malicious shortcode to be correctly stored in the database and rendered on the public frontend.

The vulnerability has a CVSS score of 8.8 (high). The impact is concrete: when the autologin_after_registration setting is enabled (default configuration), anyone who submits the registration form immediately becomes an Editor account with full WordPress backend access. Discussions on Twitter/X confirm technical details publicly (2 posts in last 24 hours). No public exploits have been reported on GitHub repositories, but the CVE was disclosed on October 31, 2026 and is under close monitoring by the security community.

IT teams and sysadmins must act immediately: verify the version of the User Frontend plugin on all managed WordPress sites. If vulnerable (version ≤ 4.3.13), temporarily disable the plugin until a verified patch is available. Review the autologin_after_registration configuration and disable it if not strictly necessary. Check posts for suspicious shortcodes, especially from Subscriber accounts. Implement WAF rules to block shortcode injection in POST parameters. Monitor authentication logs for anomalous Editor account creation.

At a glance

What: Privilege escalation in User Frontend plugin for WordPress. Authenticated users with Subscriber level inject [wpuf-registration role="editor"] shortcodes into published posts, creating a publicly visible Editor registration form.
Severity: CVSS 8.8 (high). Enables creation of Editor accounts with immediate active session when autologin_after_registration is enabled (default setting).
Affected versions: Up to and including version 4.3.13. Plugin "User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission".
Fix: Specific patch version not reported in official data. Verify availability of updates with the vendor. Affected up to version 4.3.13.
Status: Disclosed October 31, 2026. Discussion signals on Twitter/X (2 posts in last 24 hours). No public exploit declared on GitHub.
Action: Verify plugin version on all WordPress sites. Temporarily disable if vulnerable. Check autologin_after_registration configuration. Audit posts for suspicious shortcodes. Implement WAF rules.

Sources: NVD, CVE-2026-120070

← All articles