User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 4.3.11. This is due to missing validation that the caller-supplied form_id refers to an actual wpuf_forms post, and server-side submission status being determined from a client-controlled field rather than post meta. This makes it possible for authenticated attackers, with subscriber-level access and above, to create posts while bypassing subscription and payment gates by supplying a non-form post ID as the form_id parameter, or by manipulating the submission-status field to skip the posting-quota check entirely.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: User Frontend 4.3.12 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts