How do I check whether I am affected by CVE-2026-110886?

In wp-admin > Plugins, check the version of 'WPBot – ChatBot Conversational Forms'. Or run: wp plugin get conversational-forms --field=version. Versions 1.5.1 and earlier are vulnerable.

What is the fix for CVE-2026-110886?

Update to 1.5.2 or later (1.5.3 is current), or deactivate and remove the plugin. Patchstack offers a virtual-patch rule if you cannot update right away.

Who is not affected by CVE-2026-110886?

Not affected if: plugin-not-installed, version-1.5.2-or-later.

Live › vulnerability › CVE-2026-110886

Go to dashboard

critical9.8Package

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot…

WPBot – ChatBot Conversational Forms (QuantumCloud, WordPress slug conversational-forms) <= 1.5.1 has unauthenticated PHP object injection. The wpbot_capture_form_value AJAX action stores the 'answer' parameter after only sanitize_text_field(), which leaves serialized data intact. The plugin later passes the stored value through maybe_unserialize(). RCE needs a usable gadget chain from another plugin or theme. About 1,000+ active installs. Fix released 2026-10-14.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker injects PHP objects, possibly running code on the server.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-110886

Go to dashboard

critical9.8Package

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker injects PHP objects, possibly running code on the server.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources