---
id: CVE-2026-110886
title: >-
  WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object
  Injection vulnerability
summary: >-
  Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational
  Forms for ChatBot conversational-forms allows Object Injection.This issue
  affects Conversational Forms for ChatBot: from n/a through 1.5.1.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-502
vendor: QuantumCloud
product: conversational-forms
affected:
  - conversational-forms <= 1.5.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T11:00:30.021Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110886'
references:
  - url: >-
      https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-conversational-forms-for-chatbot-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve
tags:
  - cve.org
ingestedAt: '2026-10-18T11:40:26.640Z'
---

## Overview

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.

## Affected

- `conversational-forms <= 1.5.1`

## Remediation

Update the WordPress Conversational Forms for ChatBot plugin to the latest available version (at least 1.5.2).