CVE-2026-79618
WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
Unknown WP User Frontend
CVSS
4.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.3.12WP User FrontendCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Text from CVE List
Affected versions 1
- WP User Frontendaffected: all versions before 4.3.12CVE List