CVE-2026-17563
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The User Frontend WordPress plugin before version 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Risk Assessment
The risk includes unauthorized content publishing and potential financial losses from unpaid subscriptions, potentially compromising content integrity and business model.
Recommendation
Update the User Frontend plugin to version 4.3.11 or later, which enforces the subscription requirement server-side.
Other vulnerabilities in User Frontend
See all- CVE-2026-5459Medium
The User Frontend plugin for WordPress versions up to 4.3.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the payment_page() function. Missing validation on the 'user_id' parameter allows unauthenticated attackers to activate a free subscription pack for any user, overwriting their existing paid subscription and causing loss of paid features.
- CVE-2026-19116High
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form. This allows authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
- CVE-2026-14558High
The User Frontend WordPress plugin before version 4.3.10 does not properly validate field type definitions and deserializes user-controlled post metadata when rendering submitted posts. Users with Editor-level access and above can inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
- CVE-2026-12418Medium
The User Frontend plugin for WordPress up to version 4.3.7 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'wpuf_files_data' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post, including administrator posts.
- CVE-2026-12406Medium
The User Frontend plugin for WordPress up to version 4.3.7 has an authorization bypass vulnerability. Unauthenticated attackers can delete arbitrary media attachments with post_author 0 via the wpuf_file_del AJAX action.
Original NVD description (English source)
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS