CVE-2026-15962 is a deserialization of untrusted data vulnerability (CWE-502) in the Fluent Forms Pro Add On Pack plugin for WordPress. It affects all versions up to and including 6.2.6. The flaw allows authenticated attackers with at least Subscriber privileges to inject PHP objects through deserialization. A gadget chain (POP chain) enables attackers to escalate privileges by changing user passwords, potentially resulting in administrator account takeover. Exploitation requires that user update integration is enabled and a user meta field is mapped, limiting the attack surface.

Successful exploitation allows an authenticated low-privilege user to execute PHP Object Injection, leading to privilege escalation by changing passwords of other users, including administrators. This compromises confidentiality, integrity, and availability of the WordPress site and its user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling user update integration or removing user meta field mappings to prevent exploitation. Restricting Subscriber-level user capabilities and monitoring plugin updates from the vendor is recommended.