Executive Summary
CVE-2026-104738 is a PHP Object Injection vulnerability (CVSS 8.1) in the Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress. All versions up to and including 2.10.2 deserialize untrusted input, allowing unauthenticated attackers to inject a PHP object. It was published to NVD on 2026-11-07.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-104738 |
| CVSS Score | 8.1 (High) |
| Type | PHP Object Injection (CWE-502) |
| Authentication Required | None |
| Affected Versions | ≤ 2.10.2 |
| Published | 2026-11-07 |
| Source | NVD |
Technical Details
The plugin passes attacker-controlled data to PHP deserialization. Object injection alone does nothing unless a usable class (a "POP chain") exists in the running code. NVD notes that no known POP chain is present in the vulnerable plugin itself.
That does not make the issue harmless. A POP chain in any other installed plugin or theme can turn this into file deletion, arbitrary file write, SQL injection, or remote code execution. The risk depends on the rest of the site's code.
Remediation
- Update the plugin to a release later than 2.10.2 via Plugins → Updates, once available from the vendor.
- If no patch is available, deactivate the plugin.
- Reduce POP chain surface by removing unused plugins and themes.
- Review logs for unauthenticated requests to the plugin's endpoints carrying serialized PHP strings (such as
O:patterns). - Deploy a WAF rule that blocks serialized object payloads in request parameters.