This vulnerability in PDF for WPForms (add-ons.org) is due to unsafe deserialization of untrusted data, which can lead to object injection attacks. It affects all versions up to 6.5.0. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability was published on December 18, 2025, and no official patch or vendor advisory is currently available. The product is not a cloud service, so remediation depends on vendor patching or user updates.

Successful exploitation could allow an attacker to execute arbitrary code or manipulate application behavior through object injection, resulting in full compromise of confidentiality, integrity, and availability of the affected system. Given the high CVSS score and the nature of deserialization vulnerabilities, the impact is severe for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or restricting use of the PDF for WPForms plugin, especially in environments where untrusted data could be processed. Monitor vendor channels for updates and apply official fixes once released.