---
id: "CVE-2026-104738"
page: "https://infrastack.ai/live/CVE-2026-104738"
kind: "vulnerability"
aliases: ["CVE-2026-104738"]
title: "WordPress Advanced Form Integration plugin: PHP object injection through untrusted form input"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress"]
not_affected_if: ["no-active-nexforms-integration", "no-pop-chain-present", "plugin-not-installed"]
published_at: "2026-11-07T09:17:11+00:00"
first_seen_at: "2026-11-07T09:46:24+00:00"
updated_at: "2026-11-07T09:47:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104738", "first_seen_at": "2026-11-07T09:46:24+00:00"}]
exploit_sources: []
---

# WordPress Advanced Form Integration plugin: PHP object injection through untrusted form input

Link for people: https://infrastack.ai/live/CVE-2026-104738 (this .md is for agents)

The Advanced Form Integration WordPress plugin deserializes untrusted input up to and including version 2.10.2, allowing unauthenticated PHP object injection. No known gadget chain exists in the plugin itself, so code execution, file deletion or data theft depends on another installed plugin or theme providing one.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Advanced Form Integration plugin in the WordPress admin Plugins list, or in the plugin's main file header.
- Check whether at least one active NexForms integration is configured in the plugin's database table (status=1).

## Fix

- Move the Advanced Form Integration plugin to a version later than `2.10.2`; the sources do not name the exact fixed version.

## Timeline

- 2026-11-07T09:46:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104738

## From the sources

The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Exploitation requires that an administrator has previously configured at least one active NexForms integration (status=1) in the plugin's database table; in the free tier, only POST parameter keys containing the substrings 'name', 'email', 'first', or 'last' are routed to the vulnerable normalizer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_