CVE-2026-79618
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Risk Assessment
Low-privileged users can publish content without the required subscription, potentially leading to abuse, spam, or unauthorized content publication. This undermines the site's business model and access control.
Recommendation
Update the WP User Frontend plugin to version 4.3.12 or later. Review form configurations and verify that the subscription requirement is properly enforced.
Other vulnerabilities in WP User Frontend
See all- CVE-2026-81283High
The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.
- CVE-2026-52708Medium
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-48884Medium
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
- CVE-2026-95525Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
- CVE-2026-95524Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-95523Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-57334Medium
The WP User Frontend plugin versions up to 4.3.7 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to functions intended for authenticated users.
- CVE-2025-58673Medium
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend allows Code Injection. This issue affects WP User Frontend from n/a through <= 4.1.12.
- CVE-2025-58672Medium
The WP User Frontend plugin (versions up to and including 4.1.12) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may gain access to functionality reserved for higher roles.
Original NVD description (English source)
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS