CVE-2026-17563: falha de média gravidade em User Frontend
WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.3%
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · User FrontendPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — User Frontend
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14558HIGHWP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form BuilderEPSS 0.8%CVE-2026-19116HIGHWP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit FormEPSS 0.7%CVE-2026-14567MEDIUMWP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User DirectoryEPSS 0.3%CVE-2026-75823HIGHWP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role EncryptionEPSS 0.3%CVE-2026-75824MEDIUMWP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration DisabledEPSS 0.2%CVE-2026-115277MEDIUMWP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' ParameterEPSS 0.2%