CVE-2026-19116

CVE-2026-19116 is a PHP Object Injection flaw (CWE-502) in the User Frontend WordPress plugin, which does not prevent user-supplied field values from being deserialized when a submitted post is reopened in the plugin's frontend editing form. Any authenticated user with subscriber-level access or above can trigger it by reopening a submitted post through the frontend form, injecting a crafted serialized PHP object. Successful exploitation results in PHP object injection whose impact depends on gadget chains available on the site; where a suitable chain exists it can escalate to remote code execution, and the CVSS 8.8 (high) score reflects potential high impact to confidentiality, integrity, and availability. All WordPress sites running User Frontend versions prior to 4.3.11, particularly those allowing subscriber-level users to submit or edit posts via the frontend, are affected. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation is currently reported, and EPSS estimates only a ~0.5% probability of exploitation within 30 days.

What to do: Update the User Frontend plugin to version 4.3.11 or later on all affected sites. If immediate patching is not possible, restrict frontend post-editing to trusted, higher-privileged users and review installed plugins and themes for known PHP object-injection gadget chains (common in popular form, page-builder, and theme components) that could enable remote code execution. Check web server logs for suspicious serialized payloads submitted through frontend editing forms.