A critical PHP Object Injection vulnerability in the ARForms WordPress plugin could allow unauthenticated attackers to execute arbitrary code if compatible application components are present.

The plugin performs insecure deserialization of untrusted input (CWE-502). While the plugin itself does not contain a POP chain, the presence of other plugins or themes with such chains can facilitate data retrieval, file deletion, or remote code execution.

The severity of this vulnerability is contingent upon the broader environment, but the CVSS score of 9.8 highlights the potential for total system compromise. Exploitation could lead to unauthorized data access and full administrative control over the affected WordPress instance.

Immediate Action: Update the ARForms plugin to version 1.8.6 or later immediately.

Proactive Monitoring: Monitor site activity for unexpected PHP errors or signs of unauthorized file modifications that might indicate a successful injection attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious serialized objects from incoming HTTP requests.

Public Exploit Available: No.

While the immediate risk is gated by the presence of other vulnerable components, the potential for catastrophic impact mandates an immediate update. Organizations should treat this as a high-priority remediation to ensure the integrity of the WordPress application environment.