CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_subscription_cancel() function in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel any user's subscription pack, including administrators.
Explanation of Vulnerability in Simple Terms
User Frontend contains an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability affects versions up to 4.3.2. An attacker with a low-privilege account can alter information through the plugin's frontend interface without proper permission checks. Site administrators should update to a version newer than 4.3.2.
What an attacker can do
Modify data or settings they should not have permission to change via the frontend interface.
Potential impact on your site
Unauthorized users can alter site content, user profiles, or membership data depending on plugin configuration.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no special user interaction required.
Key dates
External resources
