WP User Frontend CVE-2026-79618

Requires an authenticated account at subscriber level or above (PR:L) on a WordPress site running WP User Frontend before 4.3.12 that uses the plugin's subscription-gated post-creation forms. The specific prerequisite is a form configured to restrict posting to paying subscribers; the vulnerable post-creation handler fails to enforce that subscription-purchase requirement. Whether the created post is immediately published versus held for moderation depends on the individual form's publish configuration, which limits impact on forms set to draft/pending review. Exploitation is further limited by the need for any valid low-privilege account (so sites that disable open registration raise the bar) and by the bounded integrity-only impact (no data disclosure, no availability loss).

This is a genuinely low-to-moderate priority issue despite publicly available exploit code. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 4.3 (Medium) and is internally consistent with the description: network-reachable, low complexity, but requiring low-level authentication (PR:L, i.e. subscriber-level account) and yielding only limited integrity impact (I:L) with no confidentiality or availability effect. The flaw is a broken-authorization/subscription-bypass issue, not a code-execution or data-exposure bug. A public exploit exists (per WPScan/cveorg reference), which raises practical exploitability, but there is NO EPSS score provided and NO CISA KEV listing, so there is no evidence of active exploitation - the signals do not conflict, they simply point to a low-severity integrity bug that is easy to trigger by any registered user but has bounded impact. Note the tag 'Information Disclosure' contradicts the CVSS vector (C:N), which indicates NO confidentiality impact; the real impact is unauthorized content creation/publishing, an integrity concern. The main risk is business-logic/revenue abuse (bypassing a paywall) rather than a security compromise of the host.

An attacker registers (or uses an existing) subscriber-level account on a WordPress site running WP User Frontend with a subscription-gated posting form. Instead of purchasing the required subscription, they submit the vulnerable post-creation handler directly, creating - and, depending on form configuration, immediately publishing - posts reserved for paying subscribers. A public exploit is available via WPScan, and the low complexity (AC:L) with only subscriber access (PR:L) makes this trivial to reproduce.