347 matches found
PT-2026-97477
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95523: Authentication Bypass by Spoofing
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95525: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
PT-2026-97479
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
PT-2026-97454
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Manager versions = 2.9.19...
CVE-2026-18345
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...
CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...
EUVD-2026-84307
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...
CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...
CVE-2026-18345
The WP User Manager plugin for WordPress (versions up to and including 2.9.18 ) is vulnerable to unauthorized data modification due to a missing capability check in the Connect::complete() function. This function is registered on the admin_init hook and fails to perform current_user_can() or nonc...
PT-2026-96662
Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.19 Description The plugin allows unauthorized modification of data because the Connect::complete function lacks a capability check. This function is registered on the admin init hook, which executes for an...
CVE-2026-18345: Missing Authorization
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...
WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack vulnerability
Missing Authorization to Authenticated Subscriber+ Stripe Account Hijack vulnerability discovered by Wordfence PRISM in WordPress Plugin WP User Manager versions = 2.9.18...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-17563
User Frontend WordPress plugin (versions before 4.3.11 ) enforces its subscription-purchase requirement only when rendering a frontend form, not when processing the actual post submission. This allows unauthenticated users to create—and, depending on form configuration, immediately publish —posts...
CVE-2026-81283
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...