Fluent Forms Quiz, Survey, and Drag & Drop WP Form Builder Plugin Vulnerable to PHP Object Injection

CVE-2024-4157

What is CVE-2024-4157?

The Contact Form Plugin by Fluent Forms for WordPress is susceptible to a PHP Object Injection vulnerability due to deserialization of untrusted input in the extractDynamicValues function. This flaw impacts all versions up to 5.1.15 and enables authenticated attackers with contributor-level access or higher to inject PHP objects. If a vulnerable POP chain exists through an additional plugin or theme on the target site, the attacker could potentially delete arbitrary files, access sensitive data, or execute malicious code. Securing permissions for 'View Form' and 'Manage Form' by an administrator is a requirement; however, this restriction can be circumvented when combined with CVE-2024-2771.

References