CVE-2026-14558

The User Frontend WordPress plugin before 4.3.10 fails to properly validate field type definitions and passes user-controlled post metadata to PHP unserialization when rendering submitted posts. An attacker with Editor-level access or higher on a WordPress site can craft malicious metadata that is deserialized, injecting arbitrary PHP objects. If a suitable property-oriented programming (POP) chain exists in the installed theme or plugins, this can escalate to full remote code execution; otherwise the impact is typically limited to object injection effects. Sites running an affected version of the plugin, particularly those that allow Editor- or Author-level contributors to submit content, are affected. There is no known public proof-of-concept, the flaw is not listed in CISA KEV, and current exploitation probability is low (EPSS about 0.5% over 30 days).

What to do: Update User Frontend to version 4.3.10 or later. Until patched, restrict content-submission workflows to fully trusted users and review accounts holding Editor-level or higher privileges, as these roles are sufficient to trigger the flaw. Audit installed themes and plugins for POP chains that could turn the object injection into remote code execution, and monitor logs for suspicious activity around submitted-post rendering.