WordPress Sites at Risk: Critical RCE Vulnerability in Dynamic User Directory Plugin Requires Immediate Update

Organisations using the Dynamic User Directory WordPress plugin face immediate risk from a critical security flaw that enables remote code execution. The vulnerability, identified as CVE-2026-42719, carries a CVSS score of 9.8, indicating the highest level of severity for exploitability and impact. Security teams must assess their environments for this specific plugin version to prevent potential compromise of their web infrastructure.

The flaw exists in plugin versions up to and including 2.4. It is classified as a PHP Object Injection weakness, corresponding to CWE-502. This type of vulnerability typically allows an attacker to inject malicious serialized objects into the application, which can lead to arbitrary code execution on the server hosting the WordPress site.

What we know

The National Vulnerability Database records CVE-2026-42719 as a critical issue affecting the Dynamic User Directory plugin. The plugin is developed by Sarah Giles. The vulnerability description explicitly states that it is a Subscriber PHP Object Injection flaw. This means that the injection can be triggered by users with subscriber-level privileges, significantly lowering the barrier for potential attackers.

Affected installations are those running version 2.4 or any earlier version of the Dynamic User Directory plugin. The CVSS score of 9.8 reflects the high potential for damage. PHP Object Injection vulnerabilities are particularly dangerous because they can bypass traditional input validation if the application unserializes user-controlled data without proper sanitisation.

Attackers who exploit this flaw could potentially take full control of the affected WordPress site. This could allow them to deface the website, steal sensitive data, or use the server as a pivot point for further attacks within the organisation's network. The critical rating underscores the urgency for administrators to identify and mitigate this risk.

No official patch or update has been confirmed in the available source material. Administrators should verify the current version of the plugin installed on their servers. If the version is 2.4 or lower, the site is vulnerable to this specific object injection attack.

Defender's checklist

• Identify all WordPress installations running the Dynamic User Directory plugin.
• Check the specific version number of the plugin on each affected site.
• Determine if any users with subscriber accounts have recently interacted with the plugin.
• Prepare an incident response plan in case of suspected exploitation or unauthorized access.

What to do and how to stay safe: CVE-2026-42719

• Audit your WordPress plugin inventory to locate any instances of Dynamic User Directory version 2.4 or lower.
• Restrict access to subscriber accounts and review recent activity logs for unusual serialisation patterns or unexpected code execution.
• Ensure your web application firewall is configured to detect and block common PHP object injection payloads.
• Monitor server processes and file integrity for any changes that may indicate an attacker has gained code execution capabilities.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-42719?

The CVSS score for CVE-2026-42719 is 9.8, which is rated as Critical.

Which versions of Dynamic User Directory are affected?

Versions up to and including 2.4 of the Dynamic User Directory plugin are affected.

What type of vulnerability is CVE-2026-42719?

It is a PHP Object Injection vulnerability, classified under CWE-502.