CVE-2026-19116

WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.

Affected

User Frontend

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.51% chance of exploitation in the next 30 days, 42nd percentile

Published

2026-09-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/019d83bd-24d3-4575-9d0b-55f75fdb0bfa/

References

• CVE Record
• NVD entry