WordPress Plugin Vulnerability: CVE-2026-5127 Allows Code Execution

The User Frontend plugin for WordPress (versions up to 4.3.1) contains a critical deserialization vulnerability, identified as CVE-2026-5127. According to the National Vulnerability Database, insufficient input validation on the wpuf_files parameter during form submission allows authenticated attackers, even with low-privilege Subscriber roles, to inject malicious PHP objects. This can lead to arbitrary code execution, file deletion, or other destructive actions if a suitable PHP Object Injection (POP) chain exists on the target system.

The National Vulnerability Database highlights this flaw with a CVSS score of 8.8 (HIGH). The attack vector is network-accessible (AV:N), requires low privileges (PR:L), and needs no user interaction (UI:N). The potential impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H). This is a classic insecure deserialization scenario where trust is misplaced in user-supplied data processed by PHP’s maybe_unserialize() function.