An authenticated PHP object injection vulnerability in the weDevs WP User Frontend plugin poses a high risk of remote code execution for sites running versions 4.3.10 and earlier.

This vulnerability is a deserialization of untrusted data (CWE-502) flaw occurring in the WP User Frontend plugin. It allows an authenticated user with subscriber-level privileges to inject malicious PHP objects, which can lead to remote code execution or complete site compromise.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. Successful exploitation allows an attacker to bypass security controls, resulting in unauthorized data access, modification, or full site takeover, which can cause significant reputational damage and operational downtime.

Immediate Action: Update the WP User Frontend plugin to version 4.3.11 or higher immediately to resolve the deserialization flaw.

Proactive Monitoring: Review web server and WordPress error logs for suspicious serialized strings or unexpected PHP execution patterns associated with subscriber accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization attempts targeting WordPress plugins.

Public Exploit Available: Unknown.

Given the critical nature of PHP object injection flaws, organizations should prioritize updating the WP User Frontend plugin to version 4.3.11. Although exploitation has not been confirmed, the ability for low-privileged subscribers to trigger this vulnerability makes it a high-priority target for threat actors. Apply the patch immediately to ensure the security and integrity of your WordPress environment.