EUVD-2026-28538
GHSA-jc25-ggg4-hhvw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious actions if a POP chain is present on the target system.
AnalysisAI
PHP object injection in User Frontend plugin for WordPress versions up to 4.3.1 allows authenticated attackers with Subscriber-level access or above to achieve remote code execution via unsafe deserialization of the wpuf_files parameter during form submission. The vulnerability chains input validation failures during form processing with unconditional use of maybe_unserialize() when rendering post content, enabling attackers to inject malicious PHP objects that can execute arbitrary code, delete files, or trigger other attacks through available Property-Oriented Programming (POP) chains. Wordfence disclosed detailed code references showing the vulnerable data flow across multiple plugin files including wpuf-functions.php, FieldableTrait.php, and Frontend_Form_Ajax.php, with both trunk and version 4.2.10 code paths exhibiting the flaw.
Technical ContextAI
This vulnerability exploits PHP's object serialization mechanism, specifically the unsafe use of maybe_unserialize() on attacker-controlled input. The affected plugin (CPE: cpe:2.3:a:wedevs:user_frontend) processes the wpuf_files parameter during WordPress form submissions without adequate type validation or sanitization. When users later view posts containing this tainted data, the plugin unconditionally deserializes it, allowing injection of arbitrary PHP objects. This is a classic CWE-502 (Deserialization of Untrusted Data) vulnerability. The attack leverages Property-Oriented Programming chains - sequences of existing PHP classes with magic methods (__wakeup, __destruct, __toString) that execute during deserialization. WordPress environments commonly contain POP gadgets in core, plugins, or themes (e.g., PHPMailer, Guzzle, Monolog) that can be chained to achieve file operations, database manipulation, or remote code execution. The code references show the vulnerable flow spans wpuf-functions.php line 959-1103, FieldableTrait.php lines 429-704, and Frontend_Form_Ajax.php line 35, indicating a systemic issue across form handling and content rendering logic.
RemediationAI
Immediately upgrade to User Frontend plugin version 4.3.2 or later if available, verifying the fixed version through the WordPress plugin repository or official weDevs security advisory (patch version not independently confirmed from provided data - consult https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5d27cc-c6eb-4c5c-8ee1-30483b91c6fd?source=cve for update guidance). If patched version is not yet released or immediate upgrade is not feasible, implement compensating controls: (1) Restrict user registration or disable Subscriber-level account creation to trusted users only via WordPress Settings > General > Membership, which prevents attacker account establishment but eliminates self-service registration functionality; (2) Implement Web Application Firewall rules to inspect and block serialized PHP object patterns (strings matching /O:[0-9]+:/) in wpuf_files POST parameters, though this may cause false positives with legitimate file upload metadata; (3) Audit and remove unnecessary WordPress plugins that provide known POP gadget chains (PHPMailer < 6.5.0, Guzzle, Monolog < 2.2.0) to reduce exploitability, with the trade-off of losing functionality those plugins provide. Review WordPress user roles and demote untrusted Subscriber accounts to minimize attack surface. Monitor WordPress logs for POST requests containing serialized data patterns to /wp-admin/admin-ajax.php with action parameters related to wpuf form submission.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today