CVE-2026-1867: 
WordPress vulnerability analysis and mitigation

CVE-2026-1867 is an unauthenticated sensitive information exposure vulnerability in the "Guest posting / Frontend Posting / Front Editor" (WP Front User Submit) WordPress plugin before version 5.0.6. The flaw allows an unauthenticated attacker to export and download all form data and settings — including the administrator's email address — under specific configuration conditions. It was publicly disclosed on February 18, 2026, and assigned a CVSS v3.1 base score of 5.9 (Medium) (WPScan, NVD).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The plugin accepts a URL query parameter (default_form_data) that triggers regeneration of a .json file (/wp-content/plugins/front-editor/templates/default_form_data.json) based on demo form data stored in the database. If an administrator has previously edited the demo form and enabled admin notifications, the regenerated JSON file will contain all form configuration and settings — including the admin's email address — and is then publicly accessible without authentication. Exploitation requires the specific precondition that an administrator has modified the demo form and enabled admin notifications in the plugin settings (WPScan).

Successful exploitation results in a high confidentiality impact: an unauthenticated attacker can obtain all form data and plugin settings, including the site administrator's email address. This information could be leveraged for targeted phishing, credential stuffing, or social engineering attacks against the administrator. There is no integrity or availability impact, and the scope is limited to the affected WordPress installation (WPScan, NVD).

A proof-of-concept is publicly documented in the WPScan advisory, making exploitation straightforward for any unauthenticated attacker who can reach the target site. The EPSS score is approximately 0.023%, indicating a low but non-zero probability of exploitation in the wild. No evidence of active in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported as of the time of this report (WPScan, NVD).

1. Reconnaissance: Identify WordPress sites running the "WP Front User Submit" (front-editor) plugin using tools like WPScan, Shodan, or by checking /wp-content/plugins/front-editor/ for directory listings or known files.
2. Verify precondition: Confirm that the target site's administrator has modified the demo form and enabled admin notifications in the plugin settings (this can be inferred by attempting the next steps).
3. Trigger JSON regeneration: As an unauthenticated user, send an HTTP GET request to https://example.com/?default_form_data=1 (any value works; the parameter triggers regeneration of the .json file from the demo form's post data).
4. Download sensitive data: Access https://example.com/wp-content/plugins/front-editor/templates/default_form_data.json directly to download the exported form configuration, which includes all form settings and the administrator's email address (WPScan).

• Network: Unusual HTTP GET requests to /?default_form_data= (with any value) from external or unknown IP addresses; subsequent GET requests to /wp-content/plugins/front-editor/templates/default_form_data.json from the same or different IPs.
• Logs: Web server access logs showing requests to /?default_form_data= followed by requests to the static JSON file path /wp-content/plugins/front-editor/templates/default_form_data.json, especially from non-administrative user agents or IPs.
• File System: Unexpected recent modification timestamps on /wp-content/plugins/front-editor/templates/default_form_data.json, particularly if the file was recently regenerated without a corresponding administrator action.

Update the "Guest posting / Frontend Posting / Front Editor" (WP Front User Submit) plugin to version 5.0.6 or later, which resolves this vulnerability. No official configuration-based workaround has been published; however, as an interim measure, administrators can restrict public access to the /wp-content/plugins/front-editor/templates/ directory via web server configuration (e.g., .htaccess or Nginx rules) to prevent unauthenticated file downloads. Disabling admin notifications in the plugin settings also removes the precondition required for exploitation (WPScan).

Wordfence included CVE-2026-1867 in its weekly WordPress vulnerability report for the period of March 9–15, 2026, noting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence). The vulnerability was discovered and reported by independent researcher Mike Gozdiskowski and verified by WPScan (WPScan). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator postings.