CVE-2026-1565 | User Frontend Plugin up to 4.2.8 on WordPress Setting check_filetype_and_ext unrestricted upload

A vulnerability was found in User Frontend Plugin up to 4.2.8 on WordPress. It has been rated as critical. Affected by this vulnerability is the function WPUF_Admin_Settings::check_filetype_and_ext of the component Setting Handler. The manipulation leads to unrestricted upload.

This vulnerability is listed as CVE-2026-1565. The attack may be initiated remotely. There is no available exploit.