CVE-2026-95531: WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
Published Sep 30, 2026
·Updated
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Affected Software
1 affected component
WordPress Conversational Forms for ChatBot<=1.5.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Conversational Forms for ChatBot pluginto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Subscriber-level privileges on a WordPress site running Conversational Forms for ChatBot version 1.5.0 or earlier. No user interaction is required once the attacker has those privileges.
2
What is the likely impact of successful exploitation?
The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. Successful exploitation could expose sensitive information, alter data, or disrupt the affected site.