CVE Watch26 jul 2026

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via

CVSS

8.8

Alto

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 26 jul 2026 · Última mod.: 26 jul 2026 · CWE-502

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-505179.9 CRÍ

66.4%

——20Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.2d CVE-2026-21655—

6.1%

——2Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0.2d CVE-2026-654977.2 ALT

29.6%

——9Administrator PHP Object Injection in Complianz <= 7.5.0 versions.3d CVE-2026-654937.5 ALT

29.9%

——9Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.3d CVE-2026-595449.8 CRÍ

23.7%

——7Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.3d CVE-2026-167239.0 CRÍ

33.9%

——10A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.3d