CVE-2026-15962

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions prior to 6.2.7

Description An issue exists where the plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. Authenticated users with Subscriber-level access or higher can inject a PHP Object. When combined with a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization), this allows attackers to change user passwords and potentially seize administrator accounts. This is only possible if user update integration is enabled and a user meta field is mapped.

Recommendations Update Fluent Forms Pro Add On Pack to version 6.2.7 or later. As a temporary mitigation, disable user update integration or unmap user meta fields.