CVE-2026-14567: CWE-200 Information Exposure in User Frontend

CVE-2026-14567 is an information exposure vulnerability (CWE-200) in the User Frontend WordPress plugin. Versions before 4.3.10 do not properly restrict access to the user directory search endpoint, allowing unauthenticated attackers to obtain sensitive user information such as email addresses and phone numbers for all registered users, including administrators. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can retrieve sensitive personal information (email addresses and phone numbers) of all registered users, including high-privilege accounts like administrators. This could facilitate targeted phishing or social engineering attacks but does not directly impact system integrity or availability.

No official patch or remediation level is currently confirmed. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, consider restricting access to the user directory search endpoint through web server or application-level controls if possible.