WordPress Plugin Vulnerabilities

WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

Description

The plugin does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

Proof of Concept

Affects Plugins

Fixed in 4.3.12

References

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes

Timeline

Publicly Published
2026-09-28 (about 4 days ago)
Added
2026-09-28 (about 3 days ago)
Last Updated
2026-09-28 (about 3 days ago)

Other