Vulnerability · Published Sep 2, 2026 · Assigned by WPScan
CVE-2026-17563WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
Medium 5.3
In plain English
A medium-severity missing authorization in User Frontend from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | User Frontend | 0 – before 4.3.11 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/ exploit, vdb-entry, technical-description