Dynamic User Directory EUVD-2026-96451

Exploitation requires an authenticated WordPress account at subscriber level or higher (per the 'Subscriber' designation in the Patchstack vulnerability title), so sites that disable open user registration substantially limit exposure. The attacker must reach the plugin code path that deserializes attacker-controlled input via unserialize(). Practical impact (RCE/file write/SQLi versus benign object creation) further depends on the availability of a POP gadget chain in the plugin, WordPress core, or co-installed plugins. The affected scope is Dynamic User Directory plugin versions 2.4 and earlier; sites not running this plugin are unaffected.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8 Critical) and CWE-502 (deserialization) together depict a remote, unauthenticated, low-complexity PHP Object Injection yielding high confidentiality, integrity, and availability impact - on paper a maximum-urgency flaw. However, there is a material conflict: the vulnerability title explicitly reads 'Subscriber PHP Object Injection,' and Patchstack's naming convention uses that role prefix to denote the MINIMUM privilege required to exploit, i.e. an authenticated subscriber-level account. This directly contradicts the PR:N (unauthenticated) in the supplied vector; a subscriber account is a low-privilege authenticated prerequisite, which should be PR:L and would lower the true base score toward ~8.8. This should be verified against the Patchstack advisory. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is referenced, so this is not confirmed active exploitation despite the high CVSS. Net assessment: a genuinely serious deserialization bug (object injection can chain to RCE/SQLi/file operations given a suitable gadget), but mitigated by (a) requiring an authenticated subscriber account, (b) being in a low-prevalence plugin, and (c) having no evidence of in-the-wild exploitation. Prioritize patching where the plugin is installed and user registration is open, but it is not an emergency on par with an unauthenticated internet-wide bug.

On a WordPress site running Dynamic User Directory <= 2.4 with open user registration, an attacker registers (or uses) a low-privilege subscriber account, then submits crafted input that the plugin passes to unserialize(), injecting a malicious PHP object. If a usable POP gadget chain exists in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file write, SQL injection, or remote code execution. No public exploit code is identified at time of analysis.