EUVD-2026-70035
GHSA-rgv4-fwhv-pq9x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no auth or interaction; impact is limited to unauthorized content creation with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
AnalysisAI
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The User Frontend WordPress plugin must be installed and active on the target WordPress site, and at least one frontend post-submission form must be configured with a subscription-purchase requirement restricting access to paying subscribers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.3 (I:L) is consistent with an integrity-only impact: attackers can pollute a site's content or circumvent monetization controls, but cannot read privileged data or crash the service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the User Frontend WordPress plugin to version 4.3.11 or later, which enforces the subscription check server-side during form submission processing. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Frontend
View allPHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Ed
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to perman
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the e
PHP object injection in User Frontend plugin for WordPress versions up to 4.3.1 allows authenticated attackers with Subs
Authorization bypass in the WP User Frontend (WPUF) WordPress plugin through version 4.3.7 allows unauthenticated visito
Unauthenticated content tampering in the WP User Frontend WordPress plugin (all versions through 4.3.7) allows any visit
Unauthenticated attackers can modify arbitrary WordPress posts through the User Frontend plugin (versions up to 4.2.8) d
Insecure Direct Object Reference in weDevs WP User Frontend plugin (all versions ≤4.3.1) allows unauthenticated network
Unauthorized subscription cancellation in weDevs User Frontend WordPress plugin (all versions through 4.3.2) allows any
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today