CVE-2026-14558

Name of the Vulnerable Software and Affected Versions User Frontend WordPress plugin versions prior to 4.3.10

Description Insufficient validation of field type definitions allows users with Editor-level access and above to inject arbitrary PHP objects. This occurs during the deserialization of user-controlled post metadata when rendering submitted posts, which can lead to remote code execution if a suitable POP (Property-Oriented Programming) chain is present on the site. POP chains are sequences of existing code fragments within an application that can be leveraged to execute unintended actions during object deserialization.

Recommendations Update User Frontend WordPress plugin to version 4.3.10 or later.