What happened
CVE-2026-110886 is a CVSS 9.8 unauthenticated PHP object injection (deserialization of untrusted input) in the Conversational Forms for ChatBot plugin through 1.5.1, allowing arbitrary object injection. It is fixed in 1.5.2.
Why it matters
For any site using this chatbot plugin, an unauthenticated attacker can potentially achieve remote code execution via a PHP gadget chain, taking over the WordPress host that runs the AI chatbot — despite being a niche package.
Attack vector
Unauthenticated deserialization of untrusted data (PHP object injection, CWE-502) in the chatbot form plugin, reachable from the network with no privileges.
Affected systems
Conversational Forms for ChatBot (conversational-forms) through 1.5.1
Mitigation
Upgrade to 1.5.2 (fixed version). Advisory: Patchstack WordPress Conversational Forms for ChatBot 1.5.1 PHP Object Injection.