CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
Authenticated subscribers can trigger PHP object injection via frontend post editing, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19116?
CVE-2026-19116 is a high-severity unsafe deserialization vulnerability in Unknown User Frontend, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
Weakness: CWE-502
Which versions are affected by CVE-2026-19116?
How do I fix CVE-2026-19116?
No fix has been published for CVE-2026-19116 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-19116 being exploited?
There is no known exploitation of CVE-2026-19116 in the wild and no public exploit code.
Sources
Also known as GHSA-f6hp-2qj5-48vv.