JetFormBuilder plugin for WordPress deserializes data supplied by the user. The flaw, classified as CWE-502, creates a PHP Object Injection vulnerability. Based on the description, it is inferred that an attacker could supply a crafted serialized string to construct arbitrary objects, potentially leading to remote code execution or other destructive actions if the application proceeds with the deserialized data.

The vulnerability affects JetMonsters JetFormBuilder version 3.5.1.2 and earlier. Any WordPress site that has this plugin installed, regardless of theme or other plugins, is exposed. The affected product is the JetFormBuilder plugin for WordPress, with all releases prior to and including 3.5.1.2.

The CVSS score of 7.2 categorises the issue as high severity. The EPSS score of less than 1% indicates a very low observed exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, exploitation would likely involve delivering a crafted serialized payload via a form submission or through an administrative interface that processes user input, allowing an attacker to reach the vulnerable unserialize point.