CVE-2026-79618 — WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users wit…
Published: 2026-10-02 · CVSS: 4.3 · CVSS 3.1
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7