Executive brief
User Frontend is a WordPress plugin that allows site owners to create forms for user registration, content submission, and membership management. The plugin fails to enforce subscription-purchase requirements when processing form submissions on the server side, allowing unauthenticated attackers to bypass payment restrictions and create or publish posts directly through the admin-ajax endpoint. This enables unauthorized content publication and potential defacement or spam injection.
Technical details
The vulnerability is an authorization bypass in the post submission handler. The plugin enforces subscription checks only when rendering the form to the user, but fails to re-validate the subscription requirement when the unauthenticated wpuf_submit_post AJAX action is invoked. An attacker can obtain a valid nonce from any publicly accessible guest post form, enumerate the form ID of a subscription-restricted form (which accepts guest submissions), and send a forged submission request to wp-admin/admin-ajax.php. The server processes the submission without re-checking subscription status, allowing post creation with immediate publication status. The attack requires the form to be configured with guest posting enabled, but no valid session cookie or authentication credentials.
Affected products
- WP User Frontend User Frontend before 4.3.11
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 4.3.11