Executive brief
WP User Frontend is a popular WordPress plugin used to create user registration forms, membership sites, and frontend content submission. A PHP object injection vulnerability in versions 4.3.10 and earlier allows attackers with subscriber-level access to manipulate how the site processes data and execute arbitrary code on the server, potentially compromising the entire WordPress site.
Technical details
This vulnerability is a PHP object injection flaw in WP User Frontend affecting versions up to 4.3.10. The vulnerability allows subscribers (authenticated users with limited privileges) to inject malicious serialized PHP objects that get deserialized without proper sanitization, leading to remote code execution on the web server. The attack requires an authenticated subscriber account but no elevated privileges. Patchstack has published a mitigation rule to block exploitation attempts, and the vendor released version 4.3.11 as a fix. Note: This vulnerability has also been assigned CVE-2026-19116 by another CVE Numbering Authority.
Affected products
- weDevs WP User Frontend <=4.3.10
Timeline
- 2026-09-02: disclosed
- 2026-09-01: patched: Version 4.3.11 released as patch
- 2026-09-01: advisory: Patchstack published mitigation rule