CVE-2026-81283
Received Received - Intake

Subscriber PHP Object Injection in WP User Frontend

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Patchstack

Description
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-81283
EUVD
EUVD-2026-69922

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_user_frontend wp_user_frontend to 4.3.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP Object Injection vulnerability in the WordPress WP User Frontend Plugin versions 4.3.10 and below. It allows attackers to inject malicious PHP objects that could lead to code execution, SQL injection, or other attacks if a suitable POP chain exists.

Detection Guidance

Detection primarily involves checking the installed version of the WP User Frontend plugin. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin directory for version details. Network monitoring for unusual activity may also help identify exploitation attempts.

Impact Analysis

An attacker could exploit this to execute arbitrary code, manipulate databases, access sensitive files, or cause denial of service on your website. The high CVSS score (8.8) indicates significant risk, and attacks may target any vulnerable site regardless of size.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Update the WP User Frontend plugin to version 4.3.11 or later immediately. If updating is not possible, apply the Patchstack mitigation rule to block attacks temporarily and consult your hosting provider or developer for further assistance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart