Vulnerability · Published Oct 2, 2026 · Assigned by WPScan
CVE-2026-79618WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
Medium 4.3
In plain English
A medium-severity missing authorization in WP User Frontend from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 91.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP User Frontend | 0 – before 4.3.12 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/a11bf097-3829-4baa-878c-80b113c5a744/ exploit, vdb-entry, technical-description