CVE-2026-14558CWE-502insecure-deserialization

CVE-2026-14558

High · published August 28, 2026

CVSS v3.1

7.2

EPSS

Percentile

43.1

In the wild

Unconfirmed

What it is

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00517 · 43.1th percentile
Weakness: CWE-502 · Deserialization of Untrusted Data
Published: 2026-08-28T12:16Z

References (1)

https://wpscan.com/vulnerability/217303f4-4363-46f6-8aee-8e0c1aedc271/ · [email protected]

EPSS history

Timeline

28 AUG 06:00Z
WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
cvelistv5