CVE-2024-4157 is a high severity PHP object injection flaw in the Fluent Forms contact form plugin for WordPress. NVD scores it 7.5. It affects versions up to and including 5.1.15 and needs an authenticated user with form permissions. Update to the latest version.
What's affected
The record lists the Contact Form Plugin by Fluent Forms, all versions up to and including 5.1.15. The unsafe code is in the extractDynamicValues function, which deserializes untrusted input. Authenticated users with contributor level access and above can inject a PHP object, provided they hold the View Form and Manage Form permissions that must be explicitly granted.
The record adds that harm depends on a usable POP chain, meaning a class in another plugin or theme that does something dangerous when it is deserialized. With such a chain, the record says an attacker could delete files, read sensitive data or run code. The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
The record does not give a fixed version. It points to a WordPress plugin changeset and a Wordfence entry, which we did not fetch. Check the plugin changelog for the release after 5.1.15.
Weakness class: CWE-502 (deserialization of untrusted data).
How to check if you're exposed
From the WordPress admin, open Plugins, Installed Plugins, and read the version under the plugin name. With WP-CLI on the server you can read it directly:
wp plugin list --fields=name,version,update
Compare the version to the affected range above. If the update column shows available, apply it after a backup.
Also list the users who hold form management permissions in Fluent Forms. The flaw needs those permissions.
What to do now
- Update Fluent Forms to the newest release and confirm the fix in the changelog.
- Review which users have View Form and Manage Form permissions and remove them where not needed.
- Remove contributor accounts you do not recognize.
- Update the other plugins and themes on the site. A usable POP chain lives in third party code.
- Remove plugins and themes that are not active.
Why it matters
PHP deserialization turns a stored string back into objects. If an attacker controls the string, they control which objects are built, and some classes run code as they are created or destroyed. Those classes form chains, which is why the record says the impact depends on what else is installed.
The permission requirement and the dependency on another component both lower the odds on a typical site. They do not remove the risk on a busy site with many plugins and many editors. The KEV flag is false and the record does not claim exploitation in the wild.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need an administrator account to exploit it?
No, but the user needs contributor access or above plus explicit View Form and Manage Form permissions.
Why does another plugin matter?
Impact depends on a usable POP chain in other installed code, according to the record.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
