CVE-2026-42719
CriticalCVSS 9.8Summary
The Dynamic User Directory plugin in versions up to and including 2.4 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.
Risk Assessment
An attacker with a basic account can inject a malicious PHP object, potentially leading to code execution or data disclosure. This may result in website takeover.
Recommendation
Update the Dynamic User Directory plugin to a version newer than 2.4. Until then, restrict subscriber registration.
Other vulnerabilities in Dynamic User Directory
See all- CVE-2026-42720High
The Dynamic User Directory plugin by Sarah Giles contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 2.4.
- CVE-2025-62982Medium
The Dynamic User Directory (dynamic-user-directory) plugin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), allowing Stored XSS. This issue affects Dynamic User Directory from n/a through <= 2.3.
Original NVD description (English source)
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS