CVE-2026-17563
WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
| Vendor | unknown |
| Product | user frontend |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown user frontend
Be the first to know when new medium vulnerabilities affecting unknown user frontend are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / User Frontend
0 < 4.3.11
References
Credits
Charles Vosburgh WPScan