CVE-2026-3477 is a missing authorization vulnerability (CWE-862) in the PZ Frontend Manager WordPress plugin (versions up to 1.0.6). The vulnerability exists in the pzfm_user_request_action_callback() function registered to the wp_ajax_pzfm_user_request_action hook, which lacks both capability checks and nonce verification. When the 'dataType' parameter is set to 'delete', the function calls wp_delete_user() on supplied user IDs without verifying the requester's permissions. This allows authenticated users with minimal privileges (Subscriber and above) to delete arbitrary users, including administrators. The issue stems from an authorization oversight, as a similar function in the plugin properly checks permissions before deleting users. No patch or official fix has been published as of the provided data.

An attacker with authenticated access at Subscriber level or higher can delete arbitrary WordPress users, including administrators, without proper authorization. This can lead to denial of service for legitimate users and potential loss of administrative control over the WordPress site. The vulnerability does not directly affect confidentiality or availability beyond user deletion but impacts integrity by allowing unauthorized user removals.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX endpoint by limiting user roles that can interact with the plugin or disable the plugin if feasible. Monitor for updates from the vendor or plugin maintainer to apply an official fix once released.