PHP Object Injection in ARForms Plugin for WordPress

The ARForms plugin (Contact Form, Survey, Quiz & Popup Form Builder) for WordPress contains a PHP Object Injection vulnerability in versions up to and including 1.8.5. The flaw originates from the insecure deserialization of untrusted input provided by users during form submissions. While the ARForms plugin itself does not include a POP chain, the vulnerability relies on the presence of a POP chain within other installed themes or plugins on the WordPress instance. If an attacker can leverage such a chain, they may perform unauthorized operations such as arbitrary file deletion, data exfiltration, or remote code execution. Because this vulnerability allows unauthenticated access to the deserialization process, it poses a high risk to WordPress environments that include common vulnerable plugins or complex themes.

Impact

Successful exploitation depends on the availability of a POP chain within the target's environment. If triggered, impact includes complete site compromise through remote code execution, loss of sensitive database or configuration data, or service disruption via arbitrary file deletion. The vulnerability affects all users running ARForms 1.8.5 or older.

Recommendation

• Update the ARForms plugin to the latest version immediately to remediate the insecure deserialization flaw.
• Audit installed plugins and themes to identify and remove software that contains known POP chain gadgets.
• Monitor web server logs for suspicious POST requests containing serialized PHP objects directed at endpoints associated with ARForms.