CVE-2024-13784

Name of the Vulnerable Software and Affected Versions ARForms versions prior to 1.8.6

Description The ARForms plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input received from form submissions. This allows unauthenticated attackers to inject a PHP Object. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present within the plugin itself, the issue can be exploited if another installed plugin or theme provides a POP chain. In such cases, an attacker could delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update the plugin to a version newer than 1.8.5.