Product
Frontend Dashboard and ProfileGrid WordPress plugins allow unauthenticated users to perform PHP object injection via user metadata, potentially leading to arbitrary file write and remote code execution.