CVE-2026-42719

Summary

A PHP object injection vulnerability in Dynamic User Directory plugin allows unauthenticated attackers to inject malicious PHP objects that can lead to remote code execution, data compromise, and full system takeover. The flaw occurs when user-submitted data is serialized and later unserialized without proper validation.

Exploitability

Exploitation requires no authentication and can be achieved with a single crafted HTTP request, making it highly practical for automated attacks.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to complete compromise of the web server and all hosted data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.5 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.