CVE-2026-104738

Name of the Vulnerable Software and Affected Versions Advanced Form Integration — Connect Forms to 300+ Apps versions prior to 2.10.3

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Unauthenticated attackers can inject a PHP Object, although the impact depends on the presence of a POP chain (a sequence of gadgets used to execute arbitrary code) within another installed plugin or theme. If such a chain exists, it could lead to the deletion of arbitrary files, retrieval of sensitive data, or remote code execution. Exploitation requires an administrator to have configured at least one active NexForms integration in the database. In the free tier, only POST parameter keys containing the substrings name, email, first, or last are processed by the vulnerable normalizer.

Recommendations Update to a version newer than 2.10.2.