This vulnerability is a PHP Object Injection flaw that allows an attacker to pass crafted serialized data to the Conversational Forms for ChatBot plugin. When the plugin deserializes this data without proper validation, the attacker can create arbitrary objects and ultimately execute arbitrary PHP code. The consequence is a full compromise of the affected WordPress site, giving the attacker control over the server and data. The weakness is classified as CWE-502, representing insecure serialization/deserialization.

The affected product is QuantumCloud’s Conversational Forms for ChatBot plugin for WordPress. Versions 1.5.0 and all prior releases are vulnerable. No other products or versions are listed as impacted.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, occurring when an attacker can supply the vulnerable data to the plugin, such as through a public subscriber form or a crafted HTTP request, thus enabling the object injection.