CVE-2026-17563: WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/plugin/user-frontendto a version that resolves this vulnerability.Fixed in 4.3.11
Event History
Frequently Asked Questions
Which sites are exposed to unauthorized post creation?
Sites using WP User Frontend versions earlier than 4.3.11 are exposed if they have frontend post-submission forms restricted to paying subscribers. The subscription check is applied when the form is rendered but not when a submission is processed.
Does an attacker need an account or subscription to exploit this?
No. The vulnerability allows unauthenticated users to submit posts through forms intended for paying subscribers.
Can unauthorized submissions become publicly visible immediately?
Yes, if the affected form is configured to immediately publish submitted posts. Otherwise, the impact is limited by that form's post-status configuration.
What should be checked after updating?
Review posts created through affected frontend forms, particularly any that were configured for immediate publication, for unexpected unauthenticated submissions.