PT-2026-56401 · Wedevs · User Frontend: Ai Powered Frontend Posting

Momopon1415 · Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-5459

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment page() function due to missing validation on the 'user id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-5459

Produtos afetados

User Frontend: Ai Powered Frontend Posting

Referências · 3

• https://plugins.trac.wordpress.org/changeset/3514258/wp-user-frontend · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/a02d9a01-1104-4935-8074-af4367c66278?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5459 · Nota de Segurança