CVE-2026-19116

Name of the Vulnerable Software and Affected Versions User Frontend WordPress plugin versions prior to 4.3.11

Description Authenticated users with subscriber-level access and above can perform PHP Object Injection, which may lead to remote code execution if a suitable gadget chain is present on the site. This occurs because the plugin fails to prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form. PHP Object Injection is a technique where untrusted input is passed to the unserialize() function, allowing an attacker to manipulate the object's properties and potentially execute arbitrary code.

Recommendations Update User Frontend WordPress plugin to version 4.3.11 or later.