{"id":"CVE-2026-110886","kind":"vulnerability","aliases":["CVE-2026-110886"],"related":[],"title":"Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot…","description":"Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.","summary":"WPBot – ChatBot Conversational Forms (QuantumCloud, WordPress slug conversational-forms) <= 1.5.1 has unauthenticated PHP object injection. The wpbot_capture_form_value AJAX action stores the 'answer' parameter after only sanitize_text_field(), which leaves serialized data intact. The plugin later passes the stored value through maybe_unserialize(). RCE needs a usable gadget chain from another plugin or theme. About 1,000+ active installs. Fix released 2026-10-14.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"conversational-forms","fixed":["1.5.2"],"affected":"<= 1.5.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["conversational-forms","package","php","php-object-injection","unauthenticated","wordpress","wpbot"],"not_affected_if":["plugin-not-installed","version-1.5.2-or-later"],"how_to_check":"In wp-admin > Plugins, check the version of 'WPBot – ChatBot Conversational Forms'. Or run: wp plugin get conversational-forms --field=version. Versions 1.5.1 and earlier are vulnerable.","fix":"Update to 1.5.2 or later (1.5.3 is current), or deactivate and remove the plugin. Patchstack offers a virtual-patch rule if you cannot update right away.","status":"open","published_at":"2026-10-18T11:16:37+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:04:47+00:00","updated_at":"2026-10-23T23:27:41+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:04:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"QuantumCloud Conversational Forms for ChatBot, a WordPress plugin, has an unsafe deserialization flaw that allows PHP object injection. An attacker who can send crafted input may be able to trigger object injection, which can lead to code execution depending on available gadget chains.","category":"package","who_cares":["wordpress","php","conversational-forms"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker injects PHP objects, possibly running code on the server","analyst_note":"Check NVD and the WordPress plugin changelog for the fixed version, required privileges, and the vulnerable endpoint; sources give only 'through 1.5.1'.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000444,"input_tokens":2747,"output_tokens":338,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check NVD and the WordPress plugin changelog for the fixed version, required privileges, and the vulnerable endpoint; sources give only 'through 1.5.1'.","search":"'-10':99B '-110886':14A,17A '-14':100B '-2026':13A,16A '000':93B '1':92B '1.5.1':43B,127C '2026':98B 'action':55B 'activ':94B 'affect':119C 'ajax':54B 'allow':115C 'anoth':87B 'answer':58B 'captur':51B 'chain':85B 'chatbot':11A,34B,111C,123C 'convers':8A,22B,35B,41B,108C,113C,120C 'conversational':19A 'conversational-form':21B,40B,112C 'conversational-forms':18A 'cve':12A,15A 'data':4A,68B,104C 'deseri':1A,101C 'field':64B 'fix':96B 'form':9A,23B,36B,42B,52B,109C,114C,121C 'forms':20A 'gadget':84B 'inject':29B,48B 'injection.this':117C 'instal':95B 'intact':69B 'issu':118C 'later':72B 'leav':66B 'mayb':78B 'n/a':125C 'need':81B 'object':28B,47B,116C 'packag':24B 'paramet':59B 'pass':73B 'php':25B,27B,46B 'php-object-inject':26B 'plugin':71B,88B 'quantumcloud':7A,37B,107C 'rce':80B 'releas':97B 'sanit':62B 'serial':67B 'slug':39B 'store':56B,75B 'text':63B 'theme':90B 'unauthent':30B,45B 'unseri':79B 'untrust':3A,103C 'usabl':83B 'valu':53B,76B 'vulner':5A,105C 'wordpress':31B,38B 'wpbot':32B,33B,50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110886","severity":null,"published_at":"2026-10-18T11:16:37+00:00","modified_at":"2026-10-19T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110886:446","url":null,"severity":null,"published_at":"2026-10-23T23:27:41+00:00","modified_at":"2026-10-23T23:27:41+00:00","first_seen_at":"2026-10-23T23:27:41+00:00","fetched_at":"2026-10-23T23:27:41+00:00","note":"Read Patchstack, WPSEC-2026-1088 and wordpress.org changelog: unauthenticated PHP object injection via wpbot_capture_form_value AJAX 'answer' param, fixed in 1.5.2 (1.5.3 current). No exploitation or public PoC found; no social search (low-profile plugin, ~1,000 installs). CVSS 9.8 (CNA) vs 8.1 (WPSec, AC:H): gadget chain needed for RCE."}],"documents":[{"id":1976,"url":"https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-conversational-forms-for-chatbot-plugin-1-5-1-php-object-injection-vulnerability","title":"Patchstack: Conversational Forms for ChatBot <= 1.5.1 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1979,"url":"https://wpsec.com/vuln/WPSEC-2026-1088/","title":"WPSEC-2026-1088: Unauthenticated PHP Object Injection via wpbot_capture_form_value","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1982,"url":"https://wordpress.org/plugins/conversational-forms/","title":"WPBot – ChatBot Conversational Forms (changelog, 1.5.3 current)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}