Is CVE-2026-17563 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17563 being exploited in the wild.

How severe is CVE-2026-17563?

Medium severity, with a CVSS score of 5.3, published 2 September 2026.

Which products and versions are affected?

WP User Frontend User Frontend before 4.3.11.

Is there a fix for CVE-2026-17563?

A patch was published on 2026-09-02: Fixed in version 4.3.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17563 attacked?

It is attacked over the network.

Am I affected by CVE-2026-17563?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17563: WordPress User Frontend unauthenticated post creation via subscription bypass

CVE-2026-17563 · Severity: medium · CVSS 5.3 · Published 2026-09-02

User Frontend is a WordPress plugin that allows site owners to create forms for user registration, content submission, and membership management. The plugin fails to enforce subscription-purchase requirements when processing form submissions on the server side, allowing unauthenticated attackers to bypass payment restrictions and create or publish posts directly through the admin-ajax endpoint. This enables unauthorized content publication and potential defacement or spam injection.

Quick answers

Is CVE-2026-17563 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17563 being exploited in the wild.
How severe is CVE-2026-17563?: Medium severity, with a CVSS score of 5.3, published 2 September 2026.
Which products and versions are affected?: WP User Frontend User Frontend before 4.3.11.
Is there a fix for CVE-2026-17563?: A patch was published on 2026-09-02: Fixed in version 4.3.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17563 attacked?: It is attacked over the network.
Am I affected by CVE-2026-17563?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the post submission handler. The plugin enforces subscription checks only when rendering the form to the user, but fails to re-validate the subscription requirement when the unauthenticated wpuf_submit_post AJAX action is invoked. An attacker can obtain a valid nonce from any publicly accessible guest post form, enumerate the form ID of a subscription-restricted form (which accepts guest submissions), and send a forged submission request to wp-admin/admin-ajax.php. The server processes the submission without re-checking subscription status, allowing post creation with immediate publication status. The attack requires the form to be configured with guest posting enabled, but no valid session cookie or authentication credentials.

Affected products

WP User Frontend User Frontend before 4.3.11

Timeline

2026-08-31: disclosed
2026-09-02: patched: Fixed in version 4.3.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.