CVE-2026-95531

HighCVSS 8.8

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The Conversational Forms for ChatBot plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. This allows injection of a malicious PHP object.

Risk Assessment

A low-privileged attacker (Subscriber) can inject a malicious PHP object, potentially leading to remote code execution or other severe consequences.

Recommendation

Update the Conversational Forms for ChatBot plugin to a version newer than 1.5.0.

Other vulnerabilities in Conversational Forms for ChatBot

CVE-2026-110886Critical
The Conversational Forms for ChatBot plugin (up to version 1.5.1) is vulnerable to deserialization of untrusted data, allowing object injection. An attacker can supply malicious data that gets deserialized by the application.

Original NVD description (English source)

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS