Quick answers
- Is CVE-2026-14558 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14558 being exploited in the wild.
- How severe is CVE-2026-14558?
- High severity, with a CVSS score of 7.2, published 28 August 2026.
- Which products and versions are affected?
- Orbit Fox User Frontend before 4.3.10.
- Is there a fix for CVE-2026-14558?
- A patch was published on 2026-08-28: Fixed in version 4.3.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14558 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14558?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a PHP object injection flaw (CWE-502: Deserialization of Untrusted Data) in the plugin's form builder component. The plugin fails to properly validate field type definitions and unsafely deserializes user-controlled post metadata when rendering submitted posts. An attacker with Editor-level access or higher can craft malicious serialized PHP objects that, when deserialized, trigger a POP (Property-Oriented Programming) chain to achieve remote code execution. The attack requires Editor or Administrator role, limiting the attack surface but still posing a significant risk on sites where user accounts may be compromised or where elevated permissions are delegated broadly. The vulnerability has been patched in version 4.3.10 and later.
Affected products
- Orbit Fox User Frontend before 4.3.10
Timeline
- 2026-08-26: disclosed
- 2026-08-28: advisory
- 2026-08-28: patched: Fixed in version 4.3.10