WordPress ARForms Plugin PHP Object Injection Flaw

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2024-13784 represents a critical PHP Object Injection vulnerability (CWE-502) in the ARForms WordPress plugin affecting all versions up to 1.8.5. The vulnerability stems from unsafe deserialization of untrusted input from form submissions, allowing unauthenticated attackers to inject malicious PHP objects without authentication barriers. This is particularly dangerous because WordPress plugins are ubiquitous—the ARForms plugin's form-building functionality makes it attractive to website administrators across industries. While the vulnerability itself requires an existing PHP Object Gadget (POP) chain to achieve code execution, the presence of popular plugins or themes containing such chains transforms this into a viable attack vector for remote code execution and complete site compromise.

Casky's 446 matched skills leverage Claude's extended reasoning to detect the adversarial patterns underlying this vulnerability across three critical MITRE ATT&CK techniques: Initial Access (TA0001), Persistence (TA0043), and Execution (TA0002). Practitioners using Casky would identify suspicious form submission traffic exhibiting serialized PHP object patterns, unusual parameter encoding in POST requests, and anomalous deserialization processes in application logs. The platform's skills would flag instances where untrusted user input flows directly into PHP unserialize() functions, correlate form submissions with backend object instantiation, and detect gadget chain exploitation attempts. Security teams would observe findings highlighting the critical path from unauthenticated form submission → unsafe deserialization → arbitrary object creation, enabling them to prioritize patching the plugin and auditing for complementary POP chains in their installed ecosystem before weaponization occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2024-13784.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2024-13784

Casky has 446 skills that investigate the attack patterns behind CVE-2024-13784. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn