CVE-2026-14558
High
Description
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
SeverityHigh
CVSS7.2
Exploit probability—
ProductUser Frontend
PublishedAug 28, 2026
First seenAug 28, 2026
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- User Frontend4.3.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| User Frontend | v < 4.3.10 | 4.3.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.