Critical PHP Object Injection Flaw Found in Dynamic User Directory Plugin
A CVSS 9.8 vulnerability in the Dynamic User Directory plugin allows remote attackers to inject PHP objects in versions up to 2.4.
Key points
- The National Vulnerability Database rates CVE-2026-42719 as critical with a CVSS score of 9.8.
- The flaw affects the Dynamic User Directory plugin created by Sarah Giles in versions 2.4 and earlier.
- The vulnerability is classified as a PHP Object Injection weakness under CWE-502.
The National Vulnerability Database has published a record for CVE-2026-42719, a critical security flaw in the Dynamic User Directory WordPress plugin. This vulnerability allows for PHP object injection in versions of the plugin up to and including 2.4, exposing users to significant remote compromise risks.
At a glance
- CVE
- CVE-2026-42719
- Product
- Sarah Giles Dynamic User Directory
- CVSS
- 9.8 Critical
- Weakness
- insecure deserialization
- Exploited
- No known exploitation
The issue stems from improper handling of user input within the dynamic user directory features. According to the NVD record, the weakness is categorized as CWE-502, which refers to PHP Object Injection. This type of flaw typically enables attackers to execute arbitrary code or manipulate application state by injecting serialized objects into the application logic.
Context and Background
The National Vulnerability Database assigns a Common Vulnerability Scoring System rating of 9.8 to this specific issue. This score places the vulnerability in the critical severity range, indicating that successful exploitation requires low complexity and no user interaction. The high score reflects the potential for remote attackers to gain unauthorized access to systems running the affected software.
PHP object injection vulnerabilities occur when an application deserializes untrusted data without proper validation. Attackers can craft malicious serialized strings that, when processed by the application, instantiate objects with dangerous methods. This can lead to remote code execution, data theft, or complete server takeover depending on the application’s configuration and permissions.
Who Is Affected
The vulnerability specifically impacts installations of the Dynamic User Directory plugin developed by Sarah Giles. The NVD record confirms that all versions up to 2.4 are affected by this flaw. Site administrators who have not updated their plugins beyond this version remain exposed to potential exploitation attempts.
WordPress plugins are common targets for security researchers and threat actors due to their widespread use. Plugins that handle user data or directory listings often process complex inputs, making them susceptible to injection attacks if input sanitization is insufficient. The Dynamic User Directory plugin falls into this category, handling user information dynamically.
What should you do?
Security professionals should immediately audit their WordPress environments for the presence of the Dynamic User Directory plugin. If the installed version is 2.4 or lower, the system is vulnerable to CVE-2026-42719. Administrators should check for available updates from the vendor, though no patch confirmation is provided in the current NVD record. Monitoring server logs for unusual activity is also recommended.
What to do and how to stay safe: CVE-2026-42719
- Audit your WordPress installation to identify if the Dynamic User Directory plugin is present and check its version number.
- Review server access logs for signs of exploitation attempts, such as unusual POST requests or serialized data payloads.
- Ensure that all plugins are updated to the latest available version once the vendor releases a security patch.
- Implement web application firewalls to block known exploitation patterns associated with PHP object injection attacks.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-42719?
The National Vulnerability Database rates CVE-2026-42719 with a CVSS score of 9.8, classifying it as critical.
Which versions of the Dynamic User Directory plugin are affected?
The vulnerability affects the Dynamic User Directory plugin by Sarah Giles in versions up to and including 2.4.
What type of weakness is this vulnerability?
This is a PHP Object Injection weakness, classified under CWE-502 in the Common Weakness Enumeration.
