What is the CVSS score of CVE-2026-5459?

CVE-2026-5459 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

WP User Frontend CVE-2026-5459

EUVD-2026-42229 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-08 Wordfence

GHSA-q9g5-gj6c-j62w

Authentication Bypass WordPress User Frontend

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network endpoint with no special conditions; impact is limited to subscription integrity manipulation with no confidentiality or availability effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 13:23 vuln.today

CVE Published

Jul 08, 2026 - 12:33 nvd

MEDIUM 5.3

DescriptionCVE.org

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

AnalysisAI

Insecure Direct Object Reference in weDevs WP User Frontend plugin (all versions ≤4.3.1) allows unauthenticated network attackers to activate a free subscription tier on behalf of any registered WordPress user by supplying an arbitrary user_id to the payment_page() function, silently overwriting existing paid subscriptions and revoking premium access. The root cause is a missing authorization check on a user-controlled key (CWE-639), and because WordPress user IDs are sequential integers trivially enumerable via the REST API, this is exploitable at scale with no authentication or user interaction. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack path makes this straightforward to weaponize against any site monetizing through this plugin's membership features.

Technical ContextAI

The affected component is weDevs WP User Frontend (CPE: cpe:2.3:a:wedevs:user_frontend), a WordPress plugin providing frontend posting, user directory, membership management, and subscription billing. The vulnerability exists in the payment_page() function, which processes subscription activation requests. Per CWE-639 (Authorization Through User-Controlled Key), the function accepts a user_id parameter from untrusted HTTP input and acts on the identified account without verifying that the requester owns or is authorized to modify that account. WordPress user IDs are sequential integers and are publicly discoverable through the WordPress REST API (/wp-json/wp/v2/users) and author archive URLs, giving attackers a ready-made enumeration surface for targeting any registered user.

RemediationAI

An upstream fix has been committed to the WordPress plugin repository via changeset 3514258 (https://plugins.trac.wordpress.org/changeset/3514258/wp-user-frontend), which introduces proper authorization validation to the payment_page() function. Site administrators should update WP User Frontend immediately through the WordPress plugin dashboard; the exact patched release version number is not independently confirmed from available data and should be verified against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a02d9a01-1104-4935-8074-af4367c66278 or the WordPress plugin repository changelog before deploying. As a compensating control prior to patching, administrators can configure a web application firewall rule to block unauthenticated POST requests to the payment_page endpoint that include a user_id parameter - note this may interfere with legitimate subscription flows if not scoped carefully. Disabling the subscription/membership features of the plugin entirely until patched is the most conservative interim mitigation, with the trade-off of halting new subscriber sign-ups.