CVE-2026-17563
WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 2, 2026
- Updated
- Sep 2, 2026
- Reserved
- Jul 27, 2026
Description
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
User FrontendUnknown |
|
References
- https://wpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.