Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WordPress Conversational Forms for ChatBot lets attackers run code

CVE-2026-110886 · published today
Summary

The Conversational Forms for ChatBot plugin for WordPress can be tricked into processing crafted data, allowing an attacker to run unwanted commands on the server. This could lead to unauthorized access or data loss. Update the plugin beyond version 1.5.1 or disable it until a fix is applied.

What to do
  • Update quantumcloud conversational forms for chatbot to version 1.5.2.
Affected software
VendorProductAffected versions
quantumcloud conversational forms for chatbot <= 1.5.1
Fix: upgrade to 1.5.2
Original advisory text
WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-110886 · NVD
CVE-2026-110886 · MITRE
Track software like this
Free during beta