WordPress Plugin Vulnerabilities

WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

Description

The plugin does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

Proof of Concept

Affects Plugins

Plugin icon
wp-user-frontend
Fixed in 4.3.10

References

CVE
CVE-2026-14558

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Hijun Kim
Submitter
Hijun Kim
Verified
Yes
WPVDB ID
217303f4-4363-46f6-8aee-8e0c1aedc271

Timeline

Publicly Published
2026-08-26 (about 2 days ago)
Added
2026-08-26 (about 1 day ago)
Last Updated
2026-08-26 (about 1 day ago)

Other

Published
Title
Published
2026-02-18
Title
Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection
Published
2022-08-08
Title
String Locator < 2.6.0 - Authenticated PHAR Deserialization
Published
2025-01-21
Title
Save as PDF Plugin by Pdfcrowd < 4.4.1 - Unauthenticated PHP Object Injection
Published
2026-03-23
Title
Ricky < 2.31 - Unauthenticated PHP Object Injection
Published
2025-07-18
Title
Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms < 1.1.2 - Unauthenticated PHP Object Injection via verify_field_val Function