A deserialization vulnerability in the wedevs User Frontend plugin for WordPress allows authenticated attackers with Subscriber-level access to achieve remote code execution.

This is a deserialization of untrusted data flaw (CWE-502) caused by insufficient input validation on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize(). The flaw requires authenticated access at the Subscriber level or higher.

A successful exploit allows attackers to execute arbitrary PHP code, delete arbitrary files, or perform other malicious actions on the underlying system, leading to a total compromise of confidentiality, integrity, and availability. With a CVSS score of 8.8, this high-severity vulnerability poses an immediate and severe operational risk to the affected organization.

Immediate Action: Update the wedevs User Frontend plugin to the latest patched version once available, or deactivate the plugin if no longer needed.

Proactive Monitoring: Monitor server logs and application error logs for suspicious form submissions involving unexpected object injection or unauthorized file deletions.

Compensating Controls: Implement a Web Application Firewall rule to inspect form submission parameters, such as wpuf_files, for serialized object signatures.

Public Exploit Available: No

Administrators must treat this vulnerability with high urgency due to the potential for total system compromise. Apply the vendor update immediately or remove the plugin from the environment to mitigate the risk of exploitation.