The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Techjewel |
|
| Wordpress |
|
No data.
No data.
References
History
Sun, 26 Jul 2026 02:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Techjewel
Techjewel fluent Forms Pro Add On Pack Wordpress Wordpress wordpress |
|
| Vendors & Products |
Techjewel
Techjewel fluent Forms Pro Add On Pack Wordpress Wordpress wordpress |
Sun, 26 Jul 2026 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped. | |
| Title | Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field | |
| Weaknesses | CWE-502 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2026-07-26T01:28:39.517Z
Updated: 2026-07-26T01:28:39.517Z
Reserved: 2026-07-16T14:46:28.788Z
Link: CVE-2026-15962
Vulnrichment
No data.
NVD
No data.
Redhat
No data.