Skip to content
Sign in
4.3 Medium

CVE-2026-79618 The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its…

Description

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

Affected products and versions

Product Affected versions Fixed in
WP User Frontend 4.3 earliest → < 4.3.12 4.3.12

Other CVEs of WP User Frontend

The 2 CVEs of WP User Frontend →
CVE-2021-24649 The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration… 9.8 Critical
Track this CVE