Access violation vulnerability in WP User Frontend – Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission Plugin 3.6.8

The WordPress User Frontend plugin, which is used with WordPress websites, has a security vulnerability that could allow people with subscriber-level access to do things they shouldn’t be able to do. Up to version 3.6.8 of the plugin, people with subscriber-level access would be able to install plugins, delete user packages, list taxonomies, dismiss promotional offers, review notices, and preview forms without needing permission. This vulnerability has since been fixed.