User Frontend EUVD-2026-35388

Exploitation requires a valid WordPress user account with at least Subscriber-level role on the target site, confirmed by the CVSS vector PR:L (low privilege required). The target site must have the User Frontend plugin installed, activated, and actively using its subscription pack functionality. Open user registration (WordPress default setting) would allow any unauthenticated user to self-register and then immediately exploit the flaw. What limits exploitation: the attacker must be authenticated (no unauthenticated path exists per PR:L), the plugin must be installed and active, and the target users must have subscription packs assigned. The impact is confined to subscription data modification - no code execution, no credential disclosure.

The CVSS base score of 4.3 (Medium) is appropriate for this vulnerability. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-accessible exploitation with low complexity, low required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. The practical severity is bounded by the fact that the attacker must already hold a valid WordPress account (Subscriber or above), limiting mass unauthenticated exploitation. However, in any site allowing open user registration, a Subscriber account is trivial to obtain. The primary business impact is disruption of subscription states - an attacker could cancel administrator or paying member subscriptions, causing service disruption and potential revenue loss. There is no KEV listing and no POC identified at time of analysis, keeping the immediate exploitation pressure low. EPSS data was not provided; given the authenticated requirement and limited impact scope, real-world exploitation probability is likely low but non-negligible for targeted attacks against sites with open registration.

An attacker registers a free account on the target WordPress site, obtaining Subscriber-level access. They then send a crafted authenticated HTTP request calling the user_subscription_cancel() function with the user ID of an administrator or paying member as the target parameter. Because no capability check is present, the function executes and cancels the victim's subscription pack without validation. No public exploit code has been identified, but the attack requires only knowledge of a target user ID, which can often be enumerated through WordPress's author archive URLs.