CVE-2024-4157

CVE-2024-4157 is a high-severity PHP Object Injection vulnerability affecting the Fluent Forms plugin for WordPress, impacting all versions up to and including 5.1.15. Authenticated attackers with contributor-level access and specific "View Form" and "Manage Form" permissions can inject PHP objects through untrusted input deserialization. This could lead to arbitrary file deletion, sensitive data retrieval, or remote code execution if a suitable POP chain exists. While exploitation requires specific permissions, it can be chained with CVE-2024-2771 to bypass this requirement. There is currently no public exploit code, active exploitation, or significant community discussion surrounding this vulnerability.