CVE-2026-79618

User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation

2026-09-28 00:00
Erwan LR

Strategic Overview

Status
Patched in 4.3.12
Affected Plugin
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
Affected Version
<= 4.3.11
CVSS
4.3Medium
Weakness type
CWE-602 · Client-Side Enforcement of Server-Side Security
CVE
CVE-2026-79618
View all User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission vulnerabilities

At a glance

CVE-2026-79618 is a medium-severity Client-Side Enforcement of Server-Side Security vulnerability in the User Frontend WordPress plugin, affecting versions <= 4.3.11. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Subscriber level or above. The issue is fixed in version 4.3.12; sites on affected versions should update now. Disclosed September 2026, reported by Erwan LR.

Vulnerability Overview

The User Frontend plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 4.3.11. This is due to missing server-side validation of submission state, allowing a client-supplied `wpuf_form_status` field (or the absence of `post_id`) to bypass the subscription-pack gate in the post-creation handler. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and publish posts through subscription-gated forms without purchasing the required subscription pack.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-602: Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Remediation

Update to version 4.3.12, or a newer patched version

How does WordSec protect against this?

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: User Frontend 4.3.12 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-79618https://www.wordfence.com/threat-intel/vulnerabilities/id/254591f4-9925-44c2-9644-34450520b53dhttps://nvd.nist.gov/vuln/detail/CVE-2026-79618

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C