CVE-2026-104738 · Package
NO FIX YET · SEE WHAT TO DO
The Advanced Form Integration WordPress plugin deserializes untrusted input up to and including version 2.10.2, allowing unauthenticated PHP object injection. No known gadget chain exists in the plugin itself, so code execution, file deletion or data theft depends on another installed plugin or theme providing one.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Advanced Form Integration plugin at version 2.10.2 or earlier that have at least one active NexForms integration configured. Exploitation also depends on a POP chain being present in another installed plugin or theme, so exposure is lower on sites without one. Sites without the plugin, or with a newer version, can skip it.
Not affected if no-active-nexforms-integration, no-pop-chain-present, plugin-not-installed
Who cares self-hosted, wordpress
2.10.2; the sources do not name the exact fixed version.The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Exploitation requires that an administrator has previously configured at least one active NexForms integration (status=1) in the plugin's database table; in the free tier, only POST parameter keys containing the substrings 'name', 'email', 'first', or 'last' are routed to the vulnerable normalizer.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.