LiveActive security incident?Get immediate response
CVE Record

CVE-2024-13784: Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

ARForms for WordPress through version 1.8.5 accepts unsafe serialized data from public form submissions. An attacker could inject a PHP object without logging in. Serious harm requires another installed plugin or theme containing a usable object chain, so exposure depends on each site’s full WordPress configuration.

Executive priority

Prioritize immediate inventory and containment for public sites, especially those with many plugins or themes. The maximum impact is critical, but compromise is not automatic because exploitation requires a separate POP chain. Obtain vendor-confirmed remediation before returning affected forms to normal operation.

Technical view

CVE-2024-13784 is a CWE-502 PHP object-injection flaw caused by deserializing untrusted form-submission input. It is remotely reachable without authentication or user interaction. ARForms itself reportedly has no known POP chain; file deletion, data disclosure, or code execution becomes possible only when another installed component provides one.

Likely exposure

Internet-facing WordPress sites running ARForms 1.8.5 or earlier are potentially exposed through form submissions. Practical impact is conditional: sites also need an installed plugin or theme containing a compatible POP chain. The supplied evidence does not identify which additional components qualify.

Exploitation context

The CVSS 3.1 score is 9.8 because exploitation is network-accessible, unauthenticated, and potentially compromises confidentiality, integrity, and availability. However, the CVE is not listed as KEV, and the supplied sources do not establish active exploitation or identify a public exploit.

Researcher notes

The key constraint is gadget availability outside ARForms; object injection alone does not establish code execution. The bundle’s structured affected entry lists version "0" and default status "unaffected," conflicting with the narrative’s explicit through-1.8.5 scope. No affected ecosystem components, indicators, patch version, or exploitation evidence are supplied.

Mitigation direction

  • Check the plugin page and vendor guidance for a verified fixed release or official mitigation.
  • Apply only a vendor-confirmed fixed release, then test forms before restoring public access.
  • Consider disabling affected ARForms installations until verified remediation is available.
  • Remove unnecessary plugins and themes to reduce potential POP-chain exposure.

Validation and detection

  • Inventory WordPress sites and identify every ARForms installation and version.
  • Treat versions through 1.8.5 as affected unless newer vendor guidance says otherwise.
  • Assess installed plugins and themes for compatible PHP object chains using qualified application-security review.
  • Review form-submission and server logs for anomalies; the supplied sources provide no specific indicators.
  • After remediation, confirm the vulnerable version is absent and public forms still function.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-502: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-13784 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Wordfence

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2024-13784Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineWordfence

    Vendor Notified

  3. Source timelineWordfence

    Disclosed

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
reputeinfosystemsContact Form, Survey, Quiz & Popup Form Builder – ARForms0unaffected
Weakness

CWE details

CWE-502

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-502 · source CWE mapping

Deserialization of Untrusted Data

Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs