Skip to content
Sign in
5.3 Medium

CVE-2026-5459 The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for…

Description

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

Affected products and versions

Product Affected versions Fixed in
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration 4.3 earliest → 4.3.1 No fix stated

Other CVEs of User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration

The 3 CVEs of User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration →
CVE-2026-12418 The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for… 5.3 Medium CVE-2026-12406 The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for… 5.3 Medium
Track this CVE