Hijun Kim

**Name of the Vulnerable Software and Affected Versions** User Frontend WordPress plugin versions prior to 4.3.10 **Description** Insufficient validation of field type definitions allows users with Editor-level access and above to inject arbitrary PHP objects. This occurs during the deserialization of user-controlled post metadata when rendering submitted posts, which can lead to remote code execution if a suitable POP (Property-Oriented Programming) chain is present on the site. POP chains are sequences of existing code fragments within an application that can be leveraged to execute unintended actions during object deserialization. **Recommendations** Update User Frontend WordPress plugin to version 4.3.10 or later.