CVE-2026-5459: wedevs User Frontend: AI Powered Frontend Posting, User

Описание

Оригинално описание

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

Засегнати продукти

• wedevs User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration: до 4.3.1

Вид слабост

• CWE-639 Authorization Bypass Through User-Controlled Key

История

Други уязвимости в wedevs User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration

• 5.3CVE-2026-12418
• 5.3CVE-2026-12406

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-5459
• https://nvd.nist.gov/vuln/detail/CVE-2026-5459
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a02d9a01-1104-4935-8074-af4367c66278?source=cve
• https://plugins.trac.wordpress.org/changeset/3514258/wp-user-frontend