The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers… (CVE-2026-14567)

The User Frontend WordPress plugin before version 4.3.10 does not properly restrict access to its user directory search endpoint. As a result, unauthenticated attackers can query this endpoint to obtain email addresses and phone numbers of every registered user on the site, including those with administrative privileges. This exposure of sensitive user contact information constitutes a privacy breach and could facilitate further targeted attacks.

Exposure of email addresses and phone numbers of all registered users, including administrators, to unauthenticated attackers. This could lead to privacy violations and increase the risk of targeted phishing or social engineering attacks against users and administrators.

Upgrade the User Frontend WordPress plugin to version 4.3.10 or later, where access restrictions to the user directory search endpoint have been implemented. No other mitigation guidance is provided; patching is the recommended action.