The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers,… (CVE-2026-79618)
The WP User Frontend WordPress plugin versions before 4.3.12 contain a vulnerability where the subscription-purchase requirement is not enforced in one of its post-creation handlers. This flaw allows authenticated users with subscriber-level access or higher to create and potentially publish posts via forms that are intended only for paying subscribers. The vulnerability has a medium severity score of 4.3 and does not impact confidentiality or availability but can lead to unauthorized content publication.
AI Analysis
Technical Summary
CVE-2026-79618 describes a vulnerability in the WP User Frontend WordPress plugin prior to version 4.3.12. The plugin fails to enforce subscription-purchase requirements in a specific post-creation handler, enabling authenticated users with subscriber-level permissions or above to bypass restrictions on post creation and publication. This occurs through forms that are configured to restrict posting to paying subscribers only. The issue is classified under CWE-862 (Missing Authorization).
Potential Impact
The vulnerability allows unauthorized users with subscriber-level access or higher to create and, depending on form settings, immediately publish posts that should be restricted to paying subscribers. This can lead to unauthorized content injection or publication on the affected WordPress site. There is no direct impact on confidentiality or availability.
Mitigation Recommendations
A fix is available in WP User Frontend version 4.3.12. Users should upgrade to version 4.3.12 or later to ensure the subscription-purchase requirement is properly enforced. No other mitigation guidance is provided or necessary as the issue is addressed by the official update.
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers,… (CVE-2026-79618)
Description
The WP User Frontend WordPress plugin versions before 4.3.12 contain a vulnerability where the subscription-purchase requirement is not enforced in one of its post-creation handlers. This flaw allows authenticated users with subscriber-level access or higher to create and potentially publish posts via forms that are intended only for paying subscribers. The vulnerability has a medium severity score of 4.3 and does not impact confidentiality or availability but can lead to unauthorized content publication.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-79618 describes a vulnerability in the WP User Frontend WordPress plugin prior to version 4.3.12. The plugin fails to enforce subscription-purchase requirements in a specific post-creation handler, enabling authenticated users with subscriber-level permissions or above to bypass restrictions on post creation and publication. This occurs through forms that are configured to restrict posting to paying subscribers only. The issue is classified under CWE-862 (Missing Authorization).
Potential Impact
The vulnerability allows unauthorized users with subscriber-level access or higher to create and, depending on form settings, immediately publish posts that should be restricted to paying subscribers. This can lead to unauthorized content injection or publication on the affected WordPress site. There is no direct impact on confidentiality or availability.
Mitigation Recommendations
A fix is available in WP User Frontend version 4.3.12. Users should upgrade to version 4.3.12 or later to ensure the subscription-purchase requirement is properly enforced. No other mitigation guidance is provided or necessary as the issue is addressed by the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5f7g-qp7c-jr44
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-79618"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abfeebca43b0b3b89e56603
Added to database: 10/02/2026, 17:49:48 UTC
Last enriched: 10/02/2026, 18:22:35 UTC
Last updated: 10/03/2026, 04:45:56 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.