What the vulnerability does
01Description
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious actions if a POP chain is present on the target system.
Explanation of Vulnerability in Simple Terms
02Summary
User Frontend versions up to 4.3.1 contain a deserialization vulnerability in how the plugin processes untrusted data. An authenticated attacker can craft malicious serialized objects that execute arbitrary PHP code when deserialized, compromising the entire site. This requires a valid user account but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
04Site Impact
Complete site compromise: data theft, malware injection, defacement, or total takeover possible.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account (low privilege level sufficient).
Key dates
06Disclosure timeline
May 8, 2026
CVE published
May 8, 2026
Record updated
