PHP Object Injection in Fluent Forms Pro Add On Pack for WordPress

CVE-2026-15962

What is CVE-2026-15962?

The Fluent Forms Pro Add On Pack plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This security flaw impacts all versions leading up to and including 6.2.6. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to inject a malicious PHP Object. If the user update integration feature is activated and a user meta field is mapped, attackers can leverage this vulnerability to alter user passwords and possibly gain control over administrator accounts, posing a significant threat to the integrity of WordPress websites.

References