365 matches found
WordPress WP User Frontend plugin < 4.3.12 - Subscriber+ Post Creation vulnerability
Subscriber+ Post Creation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP User Frontend versions 4.3.12...
CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
EUVD-2026-91209
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
CVE-2026-79618: Missing Authorization
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
PT-2026-104108
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
WordPress User Frontend plugin 3.5.29-4.3.11 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 3.5.29-4.3.11...
WordPress User Frontend plugin 2.5.8-4.3.11 - Unauthenticated Account Creation with Registration Disabled vulnerability
Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 2.5.8-4.3.11...
CVE-2026-75824 WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...
CVE-2026-75824
The User Frontend WordPress plugin, in versions before 4.3.12 , contains a vulnerability where it fails to verify if a site allows user registration before processing account creation. This allows unauthenticated users to create accounts on sites where registration is explicitly disabled. Any acc...
CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
CVE-2026-75823
The User Frontend WordPress plugin (versions 3.5.29 through 4.3.11 ) contains a vulnerability allowing unauthenticated privilege escalation . The root cause is a failure to prevent tampering with the role assigned by the plugin's registration form. This specifically affects installations where a ...
CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
CVE-2026-95524
Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95523
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95525
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
CVE-2026-94079
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
EUVD-2026-85494
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...