The vulnerability in the User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin allows authenticated users with Subscriber-level access or higher to inject arbitrary PHP objects through the wpuf_files parameter during form submission. This occurs because the plugin performs unconditional deserialization with maybe_unserialize() when rendering post content, and insufficient input validation and type checking permit malicious data. If a PHP Object‑on‑Path (POP) chain is available on the host, the attacker can execute arbitrary code, delete files, and perform other destructive actions.

The affected product is WeDevs' User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress. Versions up to and including 4.3.1 are vulnerable.

The CVSS score of 8.8 marks this as a high‑severitiy flaw, and although an EPSS score is not available, the lack of a KEV listing does not diminish the seriousness of the issue. The likely attack vector requires the attacker to be a legitimate user with at least Subscriber capabilities, suggesting the risk is local to users who can log in. Nonetheless, once an authenticated user injects a malicious payload, the downstream POP chain can yield remote code execution and massive damage.