CVE-2026-81283
HighCVSS 8.8Summary
The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.
Risk Assessment
The risk includes potential takeover of the WordPress site or privilege escalation by a low-privileged authenticated user.
Recommendation
Immediately update the WP User Frontend plugin to a version newer than 4.3.10 that includes the fix.
Other vulnerabilities in WP User Frontend
See all- CVE-2026-95525Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
- CVE-2026-95524Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-95523Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-57334Medium
The WP User Frontend plugin versions up to 4.3.7 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to functions intended for authenticated users.
Original NVD description (English source)
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.