PHP Object Injection Vulnerability in Advanced Form Integration Plugin for WordPress

CVE-2026-104738

What is CVE-2026-104738?

The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input. This vulnerability affects all versions up to and including 2.10.2. Unauthenticated attackers could exploit this issue if they manage to inject a PHP object when specific conditions are met, notably if at least one active NexForms integration is configured. While no direct PHP Object Patterns (POP) chain is present in the vulnerable software, attackers could potentially perform harmful actions through another installed plugin or theme containing a relevant POP chain. This may allow them to delete files, access sensitive data, or execute external code.

References