{"id":"CVE-2026-104738","kind":"vulnerability","aliases":["CVE-2026-104738"],"related":[],"title":"WordPress Advanced Form Integration plugin: PHP object injection through untrusted form input","description":"The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Exploitation requires that an administrator has previously configured at least one active NexForms integration (status=1) in the plugin's database table; in the free tier, only POST parameter keys containing the substrings 'name', 'email', 'first', or 'last' are routed to the vulnerable normalizer.","summary":"The Advanced Form Integration WordPress plugin deserializes untrusted input up to and including version 2.10.2, allowing unauthenticated PHP object injection. No known gadget chain exists in the plugin itself, so code execution, file deletion or data theft depends on another installed plugin or theme providing one.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["no-active-nexforms-integration","no-pop-chain-present","plugin-not-installed"],"how_to_check":"- Check the installed version of the Advanced Form Integration plugin in the WordPress admin Plugins list, or in the plugin's main file header.\n- Check whether at least one active NexForms integration is configured in the plugin's database table (status=1).","fix":"- Move the Advanced Form Integration plugin to a version later than `2.10.2`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-07T09:17:11+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:47:47+00:00","updated_at":"2026-11-07T09:47:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T09:47:47Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Advanced Form Integration plugin to a version later than `2.10.2`; the sources do not name the exact fixed version.","reach":"internet","title":"WordPress Advanced Form Integration plugin: PHP object injection through untrusted form input","impact":"high","summary":"The Advanced Form Integration WordPress plugin deserializes untrusted input up to and including version 2.10.2, allowing unauthenticated PHP object injection. No known gadget chain exists in the plugin itself, so code execution, file deletion or data theft depends on another installed plugin or theme providing one.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code or deletes files via a gadget chain","analyst_note":"Confirm the fixed version after 2.10.2 from the NVD entry or the WordPress plugin changelog, since the sources do not state it.","how_to_check":"- Check the installed version of the Advanced Form Integration plugin in the WordPress admin Plugins list, or in the plugin's main file header.\n- Check whether at least one active NexForms integration is configured in the plugin's database table (status=1).","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-active-nexforms-integration","no-pop-chain-present"],"who_is_affected":"Sites running the Advanced Form Integration plugin at version 2.10.2 or earlier that have at least one active NexForms integration configured. Exploitation also depends on a POP chain being present in another installed plugin or theme, so exposure is lower on sites without one. Sites without the plugin, or with a newer version, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4453,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104738':15A,18A '-2026':14A,17A '1':200C '2.10.2':38B,95C '300':77C 'action':168C 'activ':196C 'addit':152C 'administr':189C 'advanc':2A,25B,71C 'allow':39B,163C 'anoth':63B,131C 'app':78C 'arbitrari':171C 'attack':107C,165C 'chain':47B,116C,138C,147C,183C 'code':54B,178C 'configur':192C 'connect':74C 'contain':135C,215C 'cve':13A,16A 'data':59B,175C 'databas':205C 'delet':57B,170C 'depend':61B,179C 'deseri':30B,97C 'email':219C 'execut':55B,177C 'exist':48B 'exploit':185C 'file':56B,172C 'first':220C 'form':3A,11A,26B,72C,75C 'free':209C 'gadget':46B 'host':22B 'impact':129C 'includ':36B,94C 'inject':8A,43B,87C,109C 'input':12A,32B,100C 'instal':64B,140C,156C 'integr':4A,27B,73C,198C 'key':214C 'known':45B,114C 'last':222C 'least':194C 'like':169C 'make':102C 'may':162C 'mean':124C 'name':218C 'nexform':197C 'normal':228C 'object':7A,42B,86C,112C 'one':69B,195C 'packag':19B 'paramet':213C 'perform':167C 'php':6A,41B,85C,111C 'plugin':5A,29B,51B,65B,79C,132C,153C,203C 'pop':115C,137C,146C,182C 'possibl':104C 'post':212C 'present':118C,149C,184C 'previous':191C 'provid':68B 'requir':186C 'retriev':173C 'rout':224C 'self':21B 'self-host':20B 'sensit':174C 'site':143C 'softwar':122C 'status':199C 'substr':217C 'system':160C 'tabl':206C 'target':159C 'theft':60B 'theme':67B,134C,155C 'tier':210C 'unauthent':40B,106C 'unless':130C 'untrust':10A,31B,99C 'version':37B,90C 'via':96C,150C 'vulner':83C,121C,126C,227C 'wordpress':1A,23B,28B,81C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Form Integration plugin at version 2.10.2 or earlier that have at least one active NexForms integration configured. Exploitation also depends on a POP chain being present in another installed plugin or theme, so exposure is lower on sites without one. Sites without the plugin, or with a newer version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-104738':15A,18A '-2026':14A,17A 'advanc':2A 'cve':13A,16A 'form':3A,11A 'inject':8A 'input':12A 'integr':4A 'object':7A 'php':6A 'plugin':5A 'untrust':10A 'wordpress':1A","search_b":"'2.10.2':38B 'advanc':25B 'allow':39B 'anoth':63B 'chain':47B 'code':54B 'data':59B 'delet':57B 'depend':61B 'deseri':30B 'execut':55B 'exist':48B 'file':56B 'form':26B 'gadget':46B 'host':22B 'includ':36B 'inject':43B 'input':32B 'instal':64B 'integr':27B 'known':45B 'object':42B 'one':69B 'packag':19B 'php':41B 'plugin':29B,51B,65B 'provid':68B 'self':21B 'self-host':20B 'theft':60B 'theme':67B 'unauthent':40B 'untrust':31B 'version':37B 'wordpress':23B,28B","search_c":"'1':200C '2.10.2':95C '300':77C 'action':168C 'activ':196C 'addit':152C 'administr':189C 'advanc':71C 'allow':163C 'anoth':131C 'app':78C 'arbitrari':171C 'attack':107C,165C 'chain':116C,138C,147C,183C 'code':178C 'configur':192C 'connect':74C 'contain':135C,215C 'data':175C 'databas':205C 'delet':170C 'depend':179C 'deseri':97C 'email':219C 'execut':177C 'exploit':185C 'file':172C 'first':220C 'form':72C,75C 'free':209C 'impact':129C 'includ':94C 'inject':87C,109C 'input':100C 'instal':140C,156C 'integr':73C,198C 'key':214C 'known':114C 'last':222C 'least':194C 'like':169C 'make':102C 'may':162C 'mean':124C 'name':218C 'nexform':197C 'normal':228C 'object':86C,112C 'one':195C 'paramet':213C 'perform':167C 'php':85C,111C 'plugin':79C,132C,153C,203C 'pop':115C,137C,146C,182C 'possibl':104C 'post':212C 'present':118C,149C,184C 'previous':191C 'requir':186C 'retriev':173C 'rout':224C 'sensit':174C 'site':143C 'softwar':122C 'status':199C 'substr':217C 'system':160C 'tabl':206C 'target':159C 'theme':134C,155C 'tier':210C 'unauthent':106C 'unless':130C 'untrust':99C 'version':90C 'via':96C,150C 'vulner':83C,121C,126C,227C 'wordpress':81C","first_public_at":"2026-11-07T09:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104738","severity":null,"published_at":"2026-11-07T09:17:11+00:00","modified_at":"2026-11-07T09:17:12+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}