Deserialization of untrusted data in BoldGrid weForms allows attackers to inject arbitrary PHP objects. If an attacker sends a specially crafted payload to the plugin’s form processing logic, they can instantiate malicious objects that may lead to arbitrary code execution within the web server’s context. The integrity of the application is compromised, and the confidentiality of data held on the site may be exposed. Availability could also be impacted if the exploit crashes the site.

WordPress sites running the BoldGrid weForms plugin up to version 1.6.26 are affected. Any installations that have the plugin installed from the earliest release through the 1.6.26 release are vulnerable, regardless of the WordPress core version.

The vulnerability has a CVSS score of 8.8, indicating high severity. EPSS indicates it is unlikely to be widely exploited today, with a probability of less than 1%. It is not listed in the CISA KEV catalog. The likely attack vector is the submission of malicious data to the form handling endpoint; the attacker must be able to send a serialized payload that the plugin will process. Once the payload reaches the PHP interpreter, the injection can lead to remote code execution or other high‑impact actions.