PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3477 projectzealous01 CVE debrief

The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6. This vulnerability allows authenticated attackers, with Subscriber-level access and above, to delete arbitrary WordPress users, including administrators, by sending a crafted request to the AJAX endpoint. The vulnerability exists due to the pzfm_user_request_action_callback() function lacking both capability checks and nonce verification. This function handles user activation, deactivation, and deletion operations. Notably, the similar pzfm_remove_item_callback() function does check pzfm_can_delete_user() before performing deletions, indicating this was an oversight.

Vendor
projectzealous01
Product
PZ Frontend Manager
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

WordPress users with the PZ Frontend Manager plugin installed, particularly those with Subscriber-level access or higher, should be aware of this vulnerability and take steps to protect their sites. Site administrators and security teams should review the official advisory and assess their exposure to this vulnerability.

Technical summary

The pzfm_user_request_action_callback() function, registered via the wp_ajax_pzfm_user_request_action action hook, lacks both capability checks and nonce verification. When the 'dataType' parameter is set to 'delete', the function calls wp_delete_user() on all provided user IDs without verifying that the current user has the appropriate permissions. This oversight allows authenticated attackers with Subscriber-level access and above to delete arbitrary WordPress users, including administrators.

Defensive priority

Medium

Recommended defensive actions

  • Update the PZ Frontend Manager plugin to a version that includes a fix for this vulnerability.
  • Restrict access to the AJAX endpoint to prevent unauthorized requests.
  • Monitor user accounts and activity to detect potential exploitation.
  • Implement additional security measures, such as two-factor authentication and role-based access control.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-08T07:16:21.060Z and was last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Deferred. This information is based on the provided source corpus and may not reflect the full scope of the vulnerability. Defenders should verify the affected product deployments and review the official advisory for more details.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T07:16:21.060Z and has not been modified since then. The NVD entry is currently Deferred.