CVE-2026-17563CWE-862broken-access-control

CVE-2026-17563

Medium · published September 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00221 · 12.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-02T19:17Z
References (1)
https://wpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/ · [email protected]
EPSS history
Timeline
  • 04 SEP 03:38Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:16Z
    WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
    cvelistv5