QuantumCloud Conversational Forms for ChatBot: PHP Object Injection
Summary
The WordPress plugin Conversational Forms for ChatBot up to and including version 1.5.0 contains a PHP object injection flaw (CWE-502). An attacker with a low-privileged Subscriber account may be able to submit crafted serialized data, which can manipulate how the site processes data and possibly run harmful actions on the server. Patchstack rates it as high priority with a CVSS score of 8.8, and the NVD analysis is still pending.
Affected
- Conversational Forms for ChatBot (WordPress plugin, package conversational-forms) up to and including 1.5.0
- Related record CVE-2026-110886: up to and including 1.5.1 (per Patchstack and third-party trackers)
Fixed in
- Update to at least 1.5.1 (CNA record and Patchstack for CVE-2026-95531)
- Patchstack lists 1.5.2 as the fixed version of the related CVE-2026-110886; install the latest version from WordPress.org
- No vendor advisory found; fix information comes from third parties
Workaround
- No vendor-documented workaround.
- If the plugin is not essential, deactivate and remove it.
- Restrict or disable open user registration, because the attack requires a Subscriber account.
Exploitation
- Not listed in CISA KEV, according to a third-party tracker.
- Patchstack expects exploitation and mass campaigns for such flaws; this is a vendor prediction, not evidence of observed attacks.
- No public proof of concept found. Exploitation status is otherwise unknown.
Our recommendation
- Check whether the plugin is installed on any WordPress site and record the exact version.
- Update to the latest version (at least 1.5.2) or remove the plugin.
- Restrict user registration and review existing Subscriber accounts.
- Monitor web server and application logs for unusual requests, and use a virtual patch if one is available.
- Priority: high for public sites with open registration; medium if the plugin is inactive or only reachable after authentication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: PHP Object Injection (plugin <= 1.5.0) patchstack.com
- Patchstack: PHP Object Injection (plugin <= 1.5.1, related) patchstack.com
- Patchstack: Vulnerability history for Conversational Forms for ChatBot patchstack.com
- Strix: CVE-2026-95531 www.strix.ai
- Vulners: CVE-2026-110886 (CVELIST) vulners.com
- WordPress.org: Conversational Forms plugin wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:11.
Original description (NVD)
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.