CVE-2026-14558: WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Editor-level access or higher in WordPress. Unauthenticated users and lower-privileged users are not identified as able to exploit it by the available information.
What conditions are required for exploitation to result in code execution?
The attacker must be able to supply malicious post metadata through the affected field-type handling, and the site must contain a suitable PHP property-oriented programming (POP) chain. Object injection alone does not guarantee remote code execution without such a chain.
Which versions are affected?
WP User Frontend versions before 4.3.10 are affected. Updating to version 4.3.10 or later addresses the described vulnerable version range.