CVE-2024-13784
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The ARForms plugin for WordPress up to version 1.8.5 is vulnerable to PHP Object Injection via deserialization of untrusted input from form submissions. This allows unauthenticated attackers to inject a PHP object, but without a POP chain in the plugin itself, there is no impact unless another plugin or theme with a POP chain is installed.
Risk Assessment
If a POP chain is present via an additional plugin or theme, an attacker could delete files, access sensitive data, or execute code, posing a serious threat to system integrity and confidentiality.
Recommendation
Update the ARForms plugin to the latest version if a patch is available. Additionally, remove unused plugins and themes that may contain POP chains, and monitor logs for suspicious requests.
Other vulnerabilities in ARForms
See all- CVE-2026-57338High
The ARForms plugin version 7.1.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-12421High
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2024-54216High
The ARForms WordPress plugin contains a path traversal vulnerability, allowing an attacker to read files outside the application's root directory. The issue affects versions before 7.0.2.
Original NVD description (English source)
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS