CVE-2024-4157

Fluent Forms plugin for WordPress versions up to 5.1.15 contains a PHP Object Injection vulnerability in the extractDynamicValues function that processes unserialized untrusted data. Attackers with contributor-level access or higher can inject malicious PHP objects to potentially delete files, steal sensitive information, or run arbitrary code if a viable gadget chain exists in other installed plugins or themes. The vulnerability requires View Form and Manage Form permissions, though these restrictions can be circumvented by combining it with CVE-2024-2771.

Based on public CVE data (MITRE/NVD).