This vulnerability is an Insecure Direct Object Reference in the payment_page() function of the User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration plugin. The function accepts a user_id parameter without validating that the requester is allowed to modify that account, allowing unauthenticated attackers to activate or change any user’s subscription pack. The result is that a paid subscription can be overwritten with a free subset of features and the owner of the service. The weakness falls under CWE‑639, where insufficient authorization validates the privilege of an actor before performing a sensitive operation.

All installations of the wedevs User Frontend plugin with a version of 4.3.1 or earlier are impacted. The plugin is a WordPress add‑on that adds frontend posting and user management features. No information is provided that newer versions address the flaw.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is less than 1%, indicating a very low estimated probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but that does not rule out potential exploitation. The likely attack vector is sending crafted unauthenticated HTTP requests to the payment_page() endpoint with arbitrary user_id values, which results in direct modification of subscription data. Attackers can gain this capability and use it to disrupt paid services on the site. The lack of authentication checks satisfies the definition of an Insecure Direct Object Reference, and the minimal impact on system integrity does not outweigh the loss of revenue and service disruption for affected users.