CVE-2026-79618

Name of the Vulnerable Software and Affected Versions WP User Frontend WordPress plugin versions prior to 4.3.12

Description A flaw in a post-creation handler fails to enforce subscription-purchase requirements. This allows authenticated users with subscriber-level access or higher to create and potentially publish posts using forms that should be restricted to paying subscribers, depending on the specific form configuration.

Recommendations Update the plugin to version 4.3.12 or later.