WP User Frontend CVE-2026-5459

The WordPress site must be running WP User Frontend version 4.3.1 or earlier with the plugin's paid subscription or membership billing feature actively configured - the payment_page() function is the specific vulnerable entry point and is most impactful when paid tiers exist to overwrite. No authentication is required (CVSS PR:N confirmed), no user interaction is required (UI:N confirmed), and no special network positioning is needed (AV:N). The primary limiting factor is impact scope: exploitation results in subscription state manipulation only - no remote code execution, no data exfiltration, and no availability disruption are possible. Sites running WP User Frontend exclusively for frontend posting without paid membership tiers configured face no meaningful impact from this specific vulnerability.

The CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately characterizes the attack profile - unauthenticated, low-complexity, network-accessible exploitation with bounded integrity impact. Scope is not changed, and there is no confidentiality or availability component. EPSS data is not provided in available intelligence; however, the combination of AV:N/AC:L/PR:N/UI:N indicates this class of flaw is frequently automated in WordPress scanning campaigns. No CISA KEV listing is present, and no public proof-of-concept code has been identified, making confirmed active exploitation unverified at time of analysis. The real-world business impact exceeds what the CVSS score alone implies: for sites running paid membership tiers (the specific audience for this plugin), bulk subscription downgrade attacks could cause significant revenue disruption and user churn, making this a higher operational priority than a generic 5.3 would suggest for affected site operators.

An attacker scripts a loop against a target WordPress site, enumerating user IDs via the public REST API endpoint /wp-json/wp/v2/users, then sends unauthenticated HTTP requests to the payment_page() function with each discovered user_id, triggering free subscription activation for every identified account. Paid subscribers find their premium access revoked without warning, generating support tickets and potential chargebacks. No authentication, prior access, or victim interaction is required, and the entire attack can be completed in seconds against a site with hundreds of paid members.