CVE-2026-110886

9.8Critical

Published 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-502

Impact

Remote unauthenticated attackers can achieve full site takeover, arbitrary file operations, or remote code execution via PHP object injection. No prior access or user interaction is required.

Root cause

The plugin unsafely deserializes user-supplied input without proper validation.

Affected systems

QuantumCloud Conversational Forms for ChatBot (conversational-forms) through 1.5.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a version higher than 1.5.1 once published by the vendor, or deactivate and delete the plugin immediately if no patched release is available.

shell

$ wp plugin deactivate conversational-forms

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.

References

https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-conversational-forms-for-chatbot-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-110886