CVE-2026-14558: CWE-502 Deserialization of Untrusted Data in User Frontend

CVE-2026-14558 is a deserialization of untrusted data vulnerability (CWE-502) in the User Frontend WordPress plugin prior to version 4.3.10. The plugin does not properly validate field type definitions and deserializes user-controlled post metadata during post rendering. This flaw enables users with Editor-level privileges or above to inject arbitrary PHP objects. If the site contains a suitable Property Oriented Programming (POP) chain, this can result in remote code execution. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

An attacker with Editor-level or higher privileges can exploit this vulnerability to inject arbitrary PHP objects via deserialization of user-controlled data. This can lead to remote code execution on the affected site if a suitable POP chain exists. The impact includes full compromise of the WordPress site, including confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level access to trusted users only and monitor for suspicious activity related to post metadata deserialization. Avoid installing or updating to versions prior to 4.3.10 once a patch is available.