The ARForms Form Builder plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted data received from form submissions. An unauthenticated attacker can craft payloads that inject PHP objects into the plugin’s processing flow. The plugin itself contains no known return‑to‑function (ROP) or object‑oriented programming (POP) chain, so the vulnerability alone does not permit arbitrary code execution or data disclosure. However, if the target site also hosts another plugin or theme that implements a POP chain targeting vulnerable objects, the attacker could delete files, exfiltrate sensitive information, or execute code depending on the chain’s capabilities.

WordPress sites running the ARForms Form Builder plugin provided by Repute Infosystems, versions 1.8.5 and earlier. The vulnerability affects only those installations that have the plugin enabled and accept form submissions from unauthenticated users.

The CVSS score is 9.8, indicating a high severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires the attacker to submit a specially crafted form request to the vulnerable plugin, and the impact hinges on the presence of a POP chain in any other plugin or theme on the same WordPress installation. In environments where no such chain exists, the practical risk remains low, but the high CVSS rating reflects the potential severity if additional vulnerable code is present.