CVE-2024-13784 describes a PHP Object Injection vulnerability in the Contact Form, Survey, Quiz & Popup Form Builder – ARForms WordPress plugin. The flaw arises from deserializing untrusted data submitted through forms, affecting all versions up to and including 1.8.5. Exploitation requires a POP chain gadget in an additional plugin or theme installed on the same site. Without such a chain, the vulnerability cannot be leveraged to cause harm. If a POP chain is present, attackers may perform critical actions such as arbitrary file deletion, sensitive data retrieval, or code execution.

The vulnerability has a critical impact rating (CVSS 9.8) due to the potential for remote unauthenticated attackers to execute code or delete files if a POP chain is present in the environment. However, the vulnerability alone does not allow exploitation; it depends on the presence of additional vulnerable components that provide the necessary gadget chain for PHP Object Injection.

No official patch or remediation level has been published by the vendor as of now. Since exploitation requires a POP chain in other plugins or themes, site administrators should review and update all installed plugins and themes to versions without known POP chains. Monitor vendor advisories for ARForms for any forthcoming patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.