347 matches found
CVE-2026-79618
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
CVE-2026-79618
The WP User Frontend WordPress plugin, prior to version 4.3.12 , fails to enforce subscription-purchase requirements in one of its post-creation handlers. This Missing Authorization (CWE-862) flaw allows authenticated users with subscriber-level access and above to create and, depending on specif...
WordPress WP User Frontend plugin < 4.3.12 - Subscriber+ Post Creation vulnerability
Subscriber+ Post Creation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP User Frontend versions 4.3.12...
CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
EUVD-2026-91209
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
CVE-2026-79618: Missing Authorization
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
PT-2026-104108
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
WordPress User Frontend plugin 3.5.29-4.3.11 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 3.5.29-4.3.11...
WordPress User Frontend plugin 2.5.8-4.3.11 - Unauthenticated Account Creation with Registration Disabled vulnerability
Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 2.5.8-4.3.11...
CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
CVE-2026-75824
The User Frontend WordPress plugin, in versions before 4.3.12 , contains a vulnerability where it fails to verify if a site allows user registration before processing account creation. This allows unauthenticated users to create accounts on sites where registration is explicitly disabled. Any acc...
CVE-2026-75823
The User Frontend WordPress plugin (versions 3.5.29 through 4.3.11 ) contains a vulnerability allowing unauthenticated privilege escalation . The root cause is a failure to prevent tampering with the role assigned by the plugin's registration form. This specifically affects installations where a ...
CVE-2026-75824 WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...
CVE-2026-95523
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95524
Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95525
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...