{"id":"CVE-2026-17563","state":"PUBLISHED","title":"WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form","description":"The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.","publishedAt":"2026-09-02T14:16:46.353Z","updatedAt":"2026-09-02T14:57:38.402Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"WPScan"},"assigner":"WPScan","products":["Unknown User Frontend"],"affected":[{"vendor":"Unknown","product":"User Frontend","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.3.11","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/17xxx/CVE-2026-17563.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-17563","state":"PUBLISHED","datePublished":"2026-09-02T14:16:46.353Z","dateUpdated":"2026-09-02T14:57:38.402Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-07-27T14:28:04.730Z"},"containers":{"cna":{"title":"WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form","descriptions":[{"lang":"en","value":"The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers."}],"affected":[{"vendor":"Unknown","product":"User Frontend","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.3.11","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/","tags":["exploit","vdb-entry","technical-description"]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-09-02T14:16:46.353Z"},"credits":[{"lang":"en","value":"Charles Vosburgh","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-17563","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-02T14:47:43.285238Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","type":"CWE","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-02T14:57:38.402Z"}}]}}}