PT-2026-56401 · Wedevs · User Frontend: Ai Powered Frontend Posting

Momopon1415 · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-5459

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment page() function due to missing validation on the 'user id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5459

Affected Products

User Frontend: Ai Powered Frontend Posting

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-5459 · Security Note
• https://plugins.trac.wordpress.org/changeset/3514258/wp-user-frontend · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a02d9a01-1104-4935-8074-af4367c66278?source=cve · Note