CVE-2026-5459

Name of the Vulnerable Software and Affected Versions User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration versions prior to 4.3.2

Description An Insecure Direct Object Reference (IDOR) exists in the payment page() function. This issue occurs because of missing validation on the user id variable, which is controlled by the user. Unauthenticated attackers can exploit this to activate a free subscription pack for any user on the site, which overwrites existing paid subscriptions and results in the loss of paid features.

Recommendations Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to version 4.3.2 or later. As a temporary workaround, restrict access to the payment page() function until the update is applied.