CVE-2024-13784: CWE-502 Deserialization of Untrusted Data in reputeinfosystems Contact Form, Survey, Quiz & Popup Form Builder – ARForms
The ARForms WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to 1.8.5. This vulnerability allows unauthenticated attackers to inject PHP objects through form submissions. However, exploitation requires the presence of a gadget chain (POP chain) in another installed plugin or theme. Without such a chain, the vulnerability has no impact. If a POP chain exists, attackers may be able to delete files, access sensitive data, or execute code.
AI Analysis
Technical Summary
CVE-2024-13784 describes a PHP Object Injection vulnerability in the Contact Form, Survey, Quiz & Popup Form Builder – ARForms WordPress plugin affecting all versions up to and including 1.8.5. The vulnerability arises from deserialization of untrusted data submitted via forms, enabling unauthenticated attackers to inject PHP objects. Exploitation depends on the presence of a Property Oriented Programming (POP) chain in other installed plugins or themes, which could lead to arbitrary file deletion, sensitive data disclosure, or code execution. No POP chain is present in ARForms itself, limiting impact unless combined with other vulnerable components.
Potential Impact
If a POP chain is present in other installed plugins or themes, attackers can leverage this vulnerability to perform high-impact actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. Without such a chain, the vulnerability cannot be exploited to cause harm. The CVSS score of 9.8 reflects the potential critical impact under conditions where a POP chain exists.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, administrators should review installed plugins and themes for known POP chains and consider disabling or removing untrusted components. Monitoring vendor announcements for updates on ARForms is recommended.
CVE-2024-13784: CWE-502 Deserialization of Untrusted Data in reputeinfosystems Contact Form, Survey, Quiz & Popup Form Builder – ARForms
Description
The ARForms WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to 1.8.5. This vulnerability allows unauthenticated attackers to inject PHP objects through form submissions. However, exploitation requires the presence of a gadget chain (POP chain) in another installed plugin or theme. Without such a chain, the vulnerability has no impact. If a POP chain exists, attackers may be able to delete files, access sensitive data, or execute code.
CVSS v3.1
Score 9.8critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-13784 describes a PHP Object Injection vulnerability in the Contact Form, Survey, Quiz & Popup Form Builder – ARForms WordPress plugin affecting all versions up to and including 1.8.5. The vulnerability arises from deserialization of untrusted data submitted via forms, enabling unauthenticated attackers to inject PHP objects. Exploitation depends on the presence of a Property Oriented Programming (POP) chain in other installed plugins or themes, which could lead to arbitrary file deletion, sensitive data disclosure, or code execution. No POP chain is present in ARForms itself, limiting impact unless combined with other vulnerable components.
Potential Impact
If a POP chain is present in other installed plugins or themes, attackers can leverage this vulnerability to perform high-impact actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. Without such a chain, the vulnerability cannot be exploited to cause harm. The CVSS score of 9.8 reflects the potential critical impact under conditions where a POP chain exists.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, administrators should review installed plugins and themes for known POP chains and consider disabling or removing untrusted components. Monitoring vendor announcements for updates on ARForms is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-01-28T20:44:03.962Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8177c6bf8831d539cb34f3
Added to database: 08/16/2026, 08:41:42 UTC
Last enriched: 08/16/2026, 08:56:05 UTC
Last updated: 08/16/2026, 09:08:49 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.