{"id":"CVE-2026-42719","published":"2026-10-10T20:16:37.030","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A PHP object injection vulnerability in Dynamic User Directory plugin allows unauthenticated attackers to inject malicious PHP objects that can lead to remote code execution, data compromise, and full system takeover. The flaw occurs when user-submitted data is serialized and later unserialized without proper validation.","exploitability":"Exploitation requires no authentication and can be achieved with a single crafted HTTP request, making it highly practical for automated attacks.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to complete compromise of the web server and all hosted data.","remediation":"Upgrade to version 2.5 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","wordpress","php","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:33.416Z"}}