The Advanced Form Integration plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted $_POST data. An unauthenticated attacker can send crafted POST parameters to a form that has at least one active NexForms integration, causing the plugin to instantiate a PHP object with attacker-controlled values. The vulnerability is mitigated only if the target site includes a plugin or theme that contains a suitable POSt chain, as no native chain exists within the plugin itself. When such a chain is present, the attacker can delete arbitrary files, read sensitive data, or execute arbitrary code, depending on the chain’s capabilities.

WordPress sites running the Advanced Form Integration — Connect Forms to 300+ Apps plugin version 2.10.2 or earlier are affected. The plugin is maintained by nasirahmed. All installations that have the plugin enabled and have configured at least one active NexForms integration are susceptible.

The CVSS score of 8.1 indicates a high severity. The absence of an EPSS score means current exploitation probability is unknown, yet the vulnerability is readily exploitable via a simple HTTP POST request. The condition that a POP chain must exist in another plugin or theme lowers the immediate risk if no such chain is present, but the widespread use of the plugin makes the attack surface large. Because the vulnerability is unauthenticated, any user who can access the site’s form endpoints can attempt the exploit. Off‑the‑shelf mitigations, such as a web application firewall, may reduce exposure, but the definitive risk is mitigated only by patching the plugin or removing the vulnerable functionality.