CVE-2026-4058

Name of the Vulnerable Software and Affected Versions User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.3

Description The plugin is subject to unauthorized data modification because the user subscription cancel() function lacks a proper capability check. This allows authenticated attackers with Subscriber-level permissions or higher to cancel subscription packs for any user, including those with administrator privileges.

Recommendations Update to a version later than 4.3.2. As a temporary workaround, restrict access to the user subscription cancel() function to prevent unauthorized subscription cancellations.