CVE-2026-5459 describes an Insecure Direct Object Reference vulnerability in the User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration WordPress plugin by wedevs. The vulnerability exists in all versions up to and including 4.3.1 due to lack of validation on the 'user_id' parameter in the payment_page() function. This allows unauthenticated attackers to manipulate subscription status by activating free subscription packs for arbitrary users, thereby overwriting their paid subscriptions and causing loss of paid features. No official patch or remediation guidance is currently provided by the vendor.

An unauthenticated attacker can exploit this vulnerability to bypass authorization controls and activate free subscription packs on behalf of any user. This results in the victim users losing their paid subscription features, potentially causing financial and service disruption impacts. There is no indication of confidentiality or availability impact beyond subscription status modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the payment_page() function if possible and monitor for suspicious subscription changes. Avoid exposing the vulnerable plugin on publicly accessible sites or consider disabling it temporarily.