WP User Frontend < 4.3.12 - Subscriber+ Subscription Gate Bypass on Post Submission

Description

The plugin is vulnerable to Authorization Bypass due to missing validation that the caller-supplied form_id refers to an actual wpuf_forms post, and server-side submission status being determined from a client-controlled field rather than post meta. This makes it possible for authenticated attackers, with subscriber-level access and above, to create posts while bypassing subscription and payment gates by supplying a non-form post ID as the form_id parameter, or by manipulating the submission-status field to skip the posting-quota check entirely.