Executive brief
The WP User Frontend plugin for WordPress, which manages user registrations and memberships, contains a security flaw that allows unauthorized individuals to modify user subscriptions. An attacker can remotely force a free subscription onto any registered user, effectively canceling their existing paid membership. This results in a loss of premium features for customers and potential revenue disruption for site owners.
Technical details
The WP User Frontend plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 4.3.1. The vulnerability exists within the payment_page() function due to a lack of validation on the 'user_id' parameter, which is controlled by the user. An unauthenticated attacker can exploit this by sending a crafted request to activate a free subscription pack for any targeted user ID. This action overwrites the victim's current subscription, leading to an unauthorized modification of account status and loss of paid functionality. A patch has been identified in changeset 3514258.
Affected products
- weDevs WP User Frontend <= 4.3.1
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-07-08: disclosed: Wordfence vulnerability report published