Quick answers
- Is CVE-2026-5459 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-5459 being exploited in the wild.
- How severe is CVE-2026-5459?
- Medium severity, with a CVSS score of 5.3, published 8 July 2026.
- Which products and versions are affected?
- weDevs WP User Frontend <= 4.3.1.
- Is there a fix for CVE-2026-5459?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-5459 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-5459?
- Check whether you run weDevs WP User Frontend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The WP User Frontend plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 4.3.1. The vulnerability exists within the payment_page() function due to a lack of validation on the 'user_id' parameter, which is controlled by the user. An unauthenticated attacker can exploit this by sending a crafted request to activate a free subscription pack for any targeted user ID. This action overwrites the victim's current subscription, leading to an unauthorized modification of account status and loss of paid functionality. A patch has been identified in changeset 3514258.
Affected products
- weDevs WP User Frontend <= 4.3.1
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-07-08: disclosed: Wordfence vulnerability report published