Executive brief
The User Frontend WordPress plugin fails to safely process user-supplied data when posts are reopened for editing, allowing attackers to inject malicious PHP objects. Authenticated users (including basic subscribers) can exploit this to achieve remote code execution if additional gadget chains exist on the WordPress site, potentially leading to full site compromise and data theft.
Technical details
The vulnerability is a PHP Object Injection (CWE-502: Insecure Deserialization) in the User Frontend plugin's frontend post editing form. The plugin fails to validate or sanitize serialized user-supplied field values before deserializing them, allowing authenticated attackers to inject arbitrary PHP objects. Exploitation requires valid WordPress authentication (subscriber level or above) and access to the frontend post editing form. When a post is reopened for editing, the unsanitized serialized data is processed, and if a suitable gadget chain exists in the WordPress environment (from other plugins or core), this can be chained to achieve remote code execution. The vulnerability was fixed in version 4.3.11.
Affected products
- WPScan User Frontend before 4.3.11
Timeline
- 2026-08-31: disclosed: Publicly published on WPScan
- 2026-09-02: advisory: CVE-2026-19116 published
- 2026-09-02: patched: Fixed in version 4.3.11