EUVD-2026-69865
GHSA-f6hp-2qj5-48vv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or compromise subscriber account
-
DeliverySubmit post via frontend form with serialized payload
-
ExploitReopen submission to trigger unsafe deserialization
-
ExecutionInstantiate gadget chain class from installed plugin/theme
-
ImpactExecute arbitrary PHP code as web server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the User Frontend WordPress plugin version below 4.3.11 is installed and active; (2) the attacker holds at least a subscriber-level WordPress account on the target site - anonymous unauthenticated access is insufficient; (3) the WordPress installation must contain a PHP gadget chain reachable through deserialization, typically supplied by other installed plugins or themes. Sites with minimal plugin footprints or those that have audited their class-loading surface are harder to exploit. The frontend post editing workflow must be enabled and accessible to the attacker's user role. Exploitation is limited to authenticated sessions: any scenario involving unauthenticated access requires a prior account compromise step. |
| Impact | The CVSS 8.8 score using AV:N/AC:L/PR:L/UI:N reflects network accessibility with only subscriber-level authentication required, but the AC:L metric understates a real prerequisite: a usable gadget chain must exist in the target WordPress installation. In practice, most WordPress sites running multiple plugins do expose such chains (e.g., via Monolog, Symfony components, or other bundled libraries), so this caveat reduces risk only modestly - even a mid-sized municipal IT team in koszalin running a standard WordPress multisite with a few popular plugins should treat this as urgent. A public PoC from WPScan lowers the bar for exploitation significantly. EPSS data is not available in the provided intelligence, but the combination of low privilege requirement, network accessibility, public exploit code, and wide WordPress deployment footprint places this firmly in the 'prioritize immediately' tier for any site running the affected plugin version. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a WordPress site running User Frontend before 4.3.11, submits a post through the frontend form embedding a crafted serialized PHP payload in a field value, then reopens the submission to trigger deserialization. If the target WordPress installation includes a plugin or theme with a known gadget chain (e.g., a Monolog or Symfony component), the deserialization executes arbitrary PHP, granting the attacker remote code execution under the web server process. A public PoC is available via WPScan, making this attack reproducible without deep PHP exploitation expertise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-level user to trigger deserialization of attacker-controlled field values by reopening a previously submitted post in the plugin's frontend editing form. If a suitable PHP gadget chain is present in the WordPress installation - supplied by other installed themes or plugins - this escalates to full remote code execution. A public proof-of-concept is available via WPScan, making exploitation accessible to low-skilled attackers on vulnerable installs.
RemediationAI
Update the User Frontend plugin to version 4.3.11 or later immediately - this is the vendor-released patch that eliminates the unsafe deserialization. The fix can be applied through the WordPress admin panel under Plugins > Installed Plugins > Update. As a compensating control where immediate patching is not possible, restrict user registration and minimize the number of accounts with subscriber-level access or above, since exploitation requires authentication. Additionally, review installed plugins and themes for known PHP deserialization gadget chains (tools like PHPGGC can enumerate known chains) and remove unnecessary dependencies to shrink the gadget surface. Note that restricting user roles does not eliminate the vulnerability if any authenticated session can be hijacked. The WPScan advisory at https://wpscan.com/vulnerability/019d83bd-24d3-4575-9d0b-55f75fdb0bfa/ provides further detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) describes the root cause: the plugin passes user-supplied serialized field values through PHP deserialization without sanitization or integrity verification. PHP's object deserialization mechanism allows instantiation of arbitrary classes and invocation of magic methods (__wakeup, __destruct, __toString), which can be chained through pre-existing classes in the PHP runtime - so-called 'gadget chains'. WordPress environments are particularly susceptible because they load dozens of plugin and theme classes that collectively form a rich gadget surface. The affected component is the frontend post-editing form introduced by the User Frontend plugin (CPE: cpe:2.3:a:unknown:user_frontend:*:*:*:*:*:*:*:*), all versions before 4.3.11.
Know when User Frontend gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the prerequisite of a suitable gadget chain; PR:L captures mandatory subscriber-level authentication; full C/I/A impact applies if RCE is achieved.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
Technical POC Analysis
The plugin is wp-user-frontend (WP User Frontend).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The User Frontend WordPress plugin versions before 4.3.11 contain a PHP object injection vulnerability allowing authenticated subscriber-level users to trigger remote code execution on the server, provided exploitable PHP gadget chains exist in other installed plugins. Publicly available exploit code exists, making exploitation accessible to attackers with minimal WordPress privileges. This creates significant risk for WordPress sites granting subscriber-level access to external users or contractors.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in User Frontend
View allPHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Ed
Unauthenticated attachment deletion in the User Frontend WordPress plugin before 4.3.8 allows remote attackers to perman
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a s
Unauthenticated mass PII enumeration in the User Frontend WordPress plugin (versions 4.3.0 through 4.3.10) exposes the e
PHP object injection in User Frontend plugin for WordPress versions up to 4.3.1 allows authenticated attackers with Subs
Authorization bypass in the WP User Frontend (WPUF) WordPress plugin through version 4.3.7 allows unauthenticated visito
Unauthenticated content tampering in the WP User Frontend WordPress plugin (all versions through 4.3.7) allows any visit
Unauthenticated attackers can modify arbitrary WordPress posts through the User Frontend plugin (versions up to 4.2.8) d
Insecure Direct Object Reference in weDevs WP User Frontend plugin (all versions ≤4.3.1) allows unauthenticated network
Unauthorized subscription cancellation in weDevs User Frontend WordPress plugin (all versions through 4.3.2) allows any
Exploit-DB