The vulnerability is a deserialization of untrusted data that allows PHP Object Injection, which is a severe flaw capable of leading to remote code execution. The identified weakness is CWE‑502, describing failure to properly validate data during deserialization. An attacker who can supply crafted serialized data to the plugin could cause the site to instantiate arbitrary PHP objects and execute code in the server context.

QuantumCloud Conversational Forms for ChatBot plugin for WordPress, version 1.5.1 and earlier. The plugin is widely installed across many WordPress sites, so any site running a vulnerable version is potentially exposed.

The CVSS score of 9.8 indicates a Critical severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, so the public exploitation rate is currently unknown. The likely attack vector is via the plugin’s data processing endpoint, where an attacker can submit a malicious serialized payload. No authentication requirement is explicitly mentioned, so it is inferred that the attack could be performed by anyone who can interact with the plugin interface.