CVE-2026-81283: WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Published Sep 2, 2026
·Updated
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
Affected Software
1 affected component
WordPress WP User Frontend Plugin<=4.3.10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP User Frontend pluginto a version that resolves this vulnerability.Fixed in 4.3.11
Event History
Sep 2, 2026
CVE Published
via MITRE·11:37 AM
Data Sourced
via MITRE·11:37 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who needs to be authenticated to exploit this issue?
An attacker needs subscriber-level access. The attack is network-accessible, requires low complexity, and does not require user interaction.
2
What could a successful exploit allow?
The reported severity vector rates confidentiality, integrity, and availability impact as high. The vulnerability is therefore assessed as capable of causing significant impact across all three areas.
3
How can I determine whether my site is in scope?
Check whether the site uses the WP User Frontend plugin at version 4.3.10 or earlier. Sites that permit or have subscriber accounts should treat the issue as relevant.