What happened
NVD published 2026-09-30 with CVSS 8.8; Patchstack advisory documents the injection class in the chatbot-adjacent forms plugin.
Why it matters
Chatbot plugins are the entry point to WordPress AI deployments; object injection at subscriber level broadens the AI-plugin attack surface.
Attack vector
Subscriber-privilege PHP object injection reachable through the plugin's form handling path, potentially chaining to arbitrary property manipulation or code execution depending on available gadgets.
Affected systems
WordPress Conversational Forms for ChatBot plugin <= 1.5.0
Mitigation
Update the Conversational Forms for ChatBot plugin beyond 1.5.0.