CVE-2026-87741: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brainstorm Force ConvertPlus
The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset() check and fails open when the cp_admin_page_nonce parameter is omitted entirely, no capability check is performed on the callback, and sanitize_text_field() — applied to the $style value before it is concatenated directly into a shortcode string evaluated by do_shortcode() — does not strip shortcode delimiters, allowing an attacker to inject a second, fully attacker-controlled [smile_modal] invocation that causes smile_modal_popup() to pass attacker-supplied base64-decoded bytes to maybe_unserialize() with no allowed_classes restriction. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
AI Analysis
Technical Summary
CVE-2026-87741 describes a deserialization of untrusted data vulnerability in Brainstorm Force's ConvertPlus WordPress plugin versions up to and including 3.6.3. The flaw arises because the AJAX action cp_display_preview_modal's nonce check can be bypassed when the cp_admin_page_nonce parameter is missing, and no capability checks are performed. The style parameter is sanitized with sanitize_text_field(), which does not remove shortcode delimiters, allowing injection of a second shortcode [smile_modal]. This leads to smile_modal_popup() passing attacker-controlled base64-decoded data to maybe_unserialize() without allowed_classes restrictions, enabling PHP object injection. However, no gadget chain is present in ConvertPlus itself, so exploitation depends on the presence of a POP chain in other installed plugins or themes to achieve code execution or other malicious effects.
Potential Impact
If exploited in an environment where a POP chain exists in other plugins or themes, an attacker with at least Subscriber-level access could execute arbitrary code, delete files, or access sensitive data. Without such a chain, the vulnerability does not lead to direct impact. The CVSS 3.1 score is 8.8 (High), reflecting the potential severity if combined with a suitable gadget chain.
Mitigation Recommendations
No official patch or vendor advisory is provided in the data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict user roles to trusted users only and monitor for suspicious activity related to AJAX actions. Consider disabling or removing the ConvertPlus plugin if not essential. Review installed plugins and themes for known POP chains that could be leveraged in conjunction with this vulnerability.
CVE-2026-87741: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brainstorm Force ConvertPlus
Description
The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset() check and fails open when the cp_admin_page_nonce parameter is omitted entirely, no capability check is performed on the callback, and sanitize_text_field() — applied to the $style value before it is concatenated directly into a shortcode string evaluated by do_shortcode() — does not strip shortcode delimiters, allowing an attacker to inject a second, fully attacker-controlled [smile_modal] invocation that causes smile_modal_popup() to pass attacker-supplied base64-decoded bytes to maybe_unserialize() with no allowed_classes restriction. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS v3.1
Score 8.8high
Affected software
Brainstorm Force
ConvertPlus
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87741 describes a deserialization of untrusted data vulnerability in Brainstorm Force's ConvertPlus WordPress plugin versions up to and including 3.6.3. The flaw arises because the AJAX action cp_display_preview_modal's nonce check can be bypassed when the cp_admin_page_nonce parameter is missing, and no capability checks are performed. The style parameter is sanitized with sanitize_text_field(), which does not remove shortcode delimiters, allowing injection of a second shortcode [smile_modal]. This leads to smile_modal_popup() passing attacker-controlled base64-decoded data to maybe_unserialize() without allowed_classes restrictions, enabling PHP object injection. However, no gadget chain is present in ConvertPlus itself, so exploitation depends on the presence of a POP chain in other installed plugins or themes to achieve code execution or other malicious effects.
Potential Impact
If exploited in an environment where a POP chain exists in other plugins or themes, an attacker with at least Subscriber-level access could execute arbitrary code, delete files, or access sensitive data. Without such a chain, the vulnerability does not lead to direct impact. The CVSS 3.1 score is 8.8 (High), reflecting the potential severity if combined with a suitable gadget chain.
Mitigation Recommendations
No official patch or vendor advisory is provided in the data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict user roles to trusted users only and monitor for suspicious activity related to AJAX actions. Consider disabling or removing the ConvertPlus plugin if not essential. Review installed plugins and themes for known POP chains that could be leveraged in conjunction with this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-09T05:41:16.346Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abac808f7a7c541062404e5
Added to database: 09/28/2026, 20:03:20 UTC
Last enriched: 09/28/2026, 20:17:44 UTC
Last updated: 09/29/2026, 01:57:22 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.