Threats tagged 'ghsa-xqcq-7gq5-86v8'

The Advanced Form Integration plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to and including 2.10.2. Exploitation requires a previously configured active NexForms integration and presence of a PHP Object Injection POP chain in another installed plugin or theme. Without such a POP chain, the vulnerability has no impact. If exploited, it may allow attackers to delete files, retrieve sensitive data, or execute code depending on the POP chain available.