CVE-2026-5459: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite

Vulnerability summary

CVE-2026-5459 is a medium (CVSS 5.3) vulnerability in wedevs user frontend: ai powered frontend posting, user directory, profile builder, membership & user registration. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.2% of scored vulnerabilities.

Timeline

1. 08-07-2026
   PublishedVulnerability first disclosed.
2. 08-07-2026
   Last modifiedVulnerability information updated.

Description

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.