WP User Frontend CVE-2026-81283

Requires a valid WordPress subscriber-level (or higher) account on the target site. On sites with open public registration - a common and intended use case for a frontend user management plugin - any unauthenticated attacker can self-register and immediately exploit the flaw, making the effective authentication barrier negligible. Sites with closed or invitation-only registration limit the attacker pool to existing low-privilege users. Beyond account access, successful high-impact exploitation further requires the presence of a compatible PHP deserialization gadget chain within the installed plugins or themes; without one, deserialization may produce an error or a benign no-op rather than code execution. No non-default plugin configuration is required to be in the vulnerable state.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects that any authenticated subscriber - the lowest default WordPress role - can trigger this remotely with no user interaction. The real-world severity is gadget-chain-dependent: without a compatible chain in the installed plugin or theme set, practical impact is limited regardless of the CVSS score. However, Patchstack's assignment of C:H/I:H/A:H implies that the vulnerability is exploitable in common WordPress configurations, and the ecosystem makes chains statistically likely. For sites with open public registration, this effectively reduces the prerequisite to unauthenticated network access since any visitor can self-register. No EPSS score was provided in the input data. The absence of a KEV listing and public exploit suggests the vulnerability has not been observed in mass exploitation campaigns at time of analysis, but the low-friction authentication requirement warrants prompt patching.

An attacker visits a WordPress site running WP User Frontend ≤ 4.3.10 with open registration enabled, creates a subscriber account, then submits a crafted serialized PHP payload through a vulnerable plugin endpoint requiring only low-privilege authentication. If the WordPress installation includes a plugin or theme with a known deserialization gadget chain, the payload triggers a chain of magic method calls culminating in arbitrary file write or command execution, granting full server control. No public exploit code has been identified at time of analysis.