CVE-2026-110886: WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Conversational Forms for ChatBotto a version that resolves this vulnerability.Fixed in 1.5.2
Event History
Frequently Asked Questions
Which installations are affected?
QuantumCloud Conversational Forms for ChatBot installations running version 1.5.1 or earlier are affected. The affected version range is listed as n/a through 1.5.1.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What impact could successful exploitation have?
The supplied severity data rates confidentiality, integrity, and availability impact as high. The vulnerability is a PHP object injection issue caused by deserialization of untrusted data.