Aller au contenu
Se connecter
5.3 Moyenne

CVE-2026-5459 The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for…

Description

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

Produits et versions touchés

Produit Versions touchées Corrigé en
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration 4.3 premières → 4.3.1 Pas de correctif indiqué

Autres CVE de User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration

Les 3 CVE de User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration →
CVE-2026-12418 The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for… 5.3 Moyenne CVE-2026-12406 The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for… 5.3 Moyenne
Suivre cette CVE