CVE-2026-19116: WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with subscriber-level access or higher. They also need to be able to submit a crafted field value and reopen the submitted post through the plugin's frontend editing form.
Is remote code execution guaranteed?
No. The issue enables PHP object injection; remote code execution may be possible only when the affected site has a suitable PHP gadget chain available.
Which plugin versions are affected?
WP User Frontend versions before 4.3.11 are affected. Updating to version 4.3.11 or later addresses the affected version range described.