The Fluent Forms WordPress plugin up to version 5.1.15 is vulnerable to PHP Object Injection due to unsafe deserialization in the extractDynamicValues function. Authenticated attackers with contributor-level permissions or higher can inject malicious PHP objects. Exploitation depends on the presence of a gadget chain (POP chain) in other plugins or themes to achieve impactful outcomes such as arbitrary file deletion, data theft, or remote code execution. The vulnerability requires explicit 'View Form' and 'Manage Form' permissions, but this restriction can be bypassed when combined with CVE-2024-2771. The CVSS v3.1 base score is 7.5, indicating high severity.

Successful exploitation can result in high-impact consequences including confidentiality, integrity, and availability breaches: attackers may delete arbitrary files, retrieve sensitive information, or execute arbitrary code on the affected system. The attack requires authenticated access with specific permissions, limiting exposure to users with contributor-level or higher roles unless chained with another vulnerability that bypasses these restrictions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level and higher permissions carefully, especially the 'View Form' and 'Manage Form' capabilities. Monitor for updates from the vendor or security advisories regarding patches or temporary mitigations. Avoid installing untrusted plugins or themes that could provide gadget chains enabling exploitation.