A critical-severity deserialization flaw (CVSS 9.8) in the ARForms form builder plugin for WordPress lets unauthenticated attackers inject PHP objects through form submissions, with impact contingent on a POP chain being present elsewhere on the site.
What Is It
CVE-2024-13784 is a PHP Object Injection vulnerability (CWE-502) in the "Contact Form, Survey, Quiz & Popup Form Builder – ARForms" plugin for WordPress. The plugin deserializes untrusted input taken from form submissions, allowing an unauthenticated attacker to inject an arbitrary PHP object into the application.
Per the advisory, no known POP (Property-Oriented Programming) chain exists within the vulnerable plugin itself. That is an absence-of-evidence statement, not a guarantee of safety: an unpublished chain may exist in the plugin's own code, and chains are routinely discovered in code previously believed to have none. Where another installed plugin or theme supplies a usable POP chain, the injected object can be leveraged to delete arbitrary files, retrieve sensitive data, or execute code; the exact outcome depends on the chain available on the target system.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is network-reachable, requires low attack complexity, needs no privileges, and requires no user interaction. Confidentiality, integrity, and availability impacts are all rated High.
The unauthenticated attack path is the key concern: any visitor able to submit a form can reach the vulnerable deserialization. Real-world WordPress installs commonly run dozens of plugins and themes, so the "no POP chain present" caveat is a weak mitigation rather than a reliable defense.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the source material provided.
What's Vulnerable
- Vendor: reputeinfosystems
- Product: Contact Form, Survey, Quiz & Popup Form Builder – ARForms (WordPress plugin)
- Affected versions: all versions up to and including 1.8.5
Patch Status
The supplied NVD record lists a vulnerability status of "Received" and does not identify a fixed version or vendor patch. No CISA KEV required action or remediation deadline was provided in the source data. Administrators should consult the WordPress plugin page and the Wordfence advisory below for current fix availability.
Sources
- NVD, CVE-2024-13784: https://nvd.nist.gov/vuln/detail/CVE-2024-13784
- WordPress Plugin Directory; ARForms Form Builder: https://wordpress.org/plugins/arforms-form-builder/
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0116d6-91c3-4212-9c68-6b706ab09768?source=cve