Executive brief
WordPress User Frontend is a popular plugin that allows website administrators to create custom forms and user submission workflows. An authenticated attacker with Editor-level access can inject malicious PHP objects through form metadata, leading to arbitrary code execution on the server. This could allow an attacker to take full control of the WordPress site and access sensitive data.
Technical details
The vulnerability is a PHP object injection flaw (CWE-502: Deserialization of Untrusted Data) in the plugin's form builder component. The plugin fails to properly validate field type definitions and unsafely deserializes user-controlled post metadata when rendering submitted posts. An attacker with Editor-level access or higher can craft malicious serialized PHP objects that, when deserialized, trigger a POP (Property-Oriented Programming) chain to achieve remote code execution. The attack requires Editor or Administrator role, limiting the attack surface but still posing a significant risk on sites where user accounts may be compromised or where elevated permissions are delegated broadly. The vulnerability has been patched in version 4.3.10 and later.
Affected products
- Orbit Fox User Frontend before 4.3.10
Timeline
- 2026-08-26: disclosed
- 2026-08-28: advisory
- 2026-08-28: patched: Fixed in version 4.3.10