What is the CVSS score of CVE-2026-32484?

CVE-2026-32484 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Weforms are affected by CVE-2026-32484?

Organizations using Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms face significant risk from CVE-2026-32484, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-32484?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Weforms CVE-2026-32484

EUVD-2026-15828 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

Deserialization Weforms

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15828

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.

AnalysisAI

A PHP object injection vulnerability exists in BoldGrid weForms plugin through version 1.6.26 due to unsafe deserialization of untrusted data, allowing attackers to instantiate arbitrary objects and potentially execute remote code or manipulate application state. This affects WordPress installations using the vulnerable weForms plugin versions, and exploitation requires no authentication based on the deserialization attack vector. While no CVSS score or EPSS data is currently available, the CWE-502 classification and object injection capability represent a critical-severity issue typical of deserialization flaws that often lead to remote code execution.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a well-known attack vector in PHP applications where user-controlled input is passed to unserialize() or similar functions without proper validation. The BoldGrid weForms plugin (CPE: cpe:2.3:a:boldgrid:weforms:*:*:*:*:*:*:*:*) appears to deserialize form data or configuration parameters without sanitizing the input first, enabling PHP object injection. In PHP, object injection can chain existing gadgets in loaded libraries (such as WordPress core or plugins) to achieve arbitrary code execution, file writes, or SQL injection. The weForms plugin, designed for WordPress form handling, likely accepts serialized data through form submissions, AJAX endpoints, or stored settings, creating multiple potential injection points.

RemediationAI

Immediately upgrade BoldGrid weForms to the latest patched version released after 1.6.26 via the WordPress plugin update mechanism or by downloading from the official BoldGrid/WordPress plugin repository. If a patched version is not yet available, disable the weForms plugin entirely until a fix is released, and review form handling functionality with alternative plugins. As a temporary mitigation, restrict form submission endpoints at the web application firewall or reverse proxy to reject serialized PHP objects in POST/GET parameters by blocking common serialization patterns (detect 'O:' strings in request bodies). Implement strict input validation on any remaining form handlers and ensure PHP's disable_classes and disable_functions directives are used to restrict dangerous object instantiation where possible. Monitor the Patchstack security advisory and BoldGrid's official channels for patch release announcements.