ChatBot Conversational Forms CVE-2026-110886

Requires that the Conversational Forms for ChatBot plugin (version ≤1.5.1) be installed and active on a WordPress site, and that a reachable code path passes attacker-controlled input to PHP unserialize(). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and the attack is remote. The key LIMITING factor not captured by CVSS is the PHP Object Injection prerequisite: successful exploitation beyond the injection itself depends on a usable POP gadget chain existing in the plugin, WordPress core, or another installed component - absent such a chain, impact may be limited to denial of service or be non-exploitable. No plugin-specific feature toggle or non-default configuration is named in the Description.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes an unauthenticated, network-reachable, low-complexity flaw with full confidentiality, integrity and availability impact - the classic profile of a critical pre-auth RCE-class WordPress plugin bug. However, several real-world risk signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no indication of public exploit code. CWE-502 PHP Object Injection vulnerabilities are a nuance here: raw CVSS routinely rates them 9.8, but practical impact depends on whether an exploitable POP (property-oriented programming) gadget chain is reachable in the plugin, WordPress core, or another installed plugin - Patchstack frequently notes that no known POP chain exists, which would make C:H/I:H/A:H aspirational rather than demonstrated. No such gadget-chain detail is provided in this input, so the 9.8 should be treated as an upper bound, not a confirmed end-to-end compromise. Net: this is a genuine priority to patch given the pre-auth network vector and the dangerous CWE class, but in the absence of EPSS, KEV, or POC data the 9.8 likely overstates immediately weaponizable risk - treat as high-priority-patch rather than confirmed under-attack.

An unauthenticated attacker sends a crafted request to a WordPress site running Conversational Forms for ChatBot (≤1.5.1), supplying a malicious serialized PHP object to a form-handling endpoint that calls unserialize() on attacker-controlled input. If a usable POP gadget chain is present in the stack, deserialization triggers it to achieve code execution, file operations, or data tampering. No public proof-of-concept is identified at time of analysis, and real impact is contingent on an available gadget chain.