Security Alert Summary
The ConvertPlus plugin for WordPress contains a deserialization of untrusted data vulnerability that can be reached via the style parameter of the cp_display_preview_modal AJAX action. Authenticated users with Subscriber-level access and above can inject a PHP object through a crafted input when certain checks are omitted, which may lead to serious impacts if a gadget or POP chain is present in another plugin or theme on the site.
CVE Details
- CVE ID: CVE-2026-87741
- Affected component: ConvertPlus plugin for WordPress (Brainstorm Force)
- Affected versions: All versions up to and including 3.6.3
- Published: September 28, 2026 at 8:17:11 PM UTC
- Last modified: September 28, 2026 at 8:51:05 PM UTC
- CVSS v3.1 base score: 8.8
- CVSS v3.1 severity: HIGH
- CVSS vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Privileges Required: Low (authenticated user such as Subscriber-level); User Interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness ID: CWE-78
Technical Details
The vulnerability is a deserialization of untrusted data issue triggered via the style parameter of the cp_display_preview_modal AJAX action. The action’s nonce guard is gated behind an isset() check and fails open if the cp_admin_page_nonce parameter is omitted entirely. The AJAX callback contains no capability check.
Input sent in style is passed through sanitize_text_field() and then concatenated into a shortcode string that is evaluated with do_shortcode(). Because sanitize_text_field() does not strip shortcode delimiters, an attacker can inject a second, attacker-controlled [smile_modal] invocation. That callback causes smile_modal_popup() to pass attacker-supplied base64-decoded bytes to maybe_unserialize() with no allowed_classes restriction, allowing injection of a PHP object.
The vendor analysis notes there is no known POP chain present in the vulnerable software itself; therefore this vulnerability has no impact unless another installed plugin or theme provides a POP chain. If such a POP chain exists on the target system, it could enable actions such as deleting files, retrieving sensitive data, or executing code depending on the available gadget chain.
How This Could Impact Your Website
Consider a site with multiple WordPress users: the site owner, internal staff members with Editor or Author roles, and external contractors or contributors assigned Subscriber-level accounts. An authenticated attacker with a Subscriber account could exploit this flaw to inject a PHP object if another plugin or theme on the site exposes a POP chain. In that scenario, the attacker might be able to perform actions that affect data confidentiality, integrity, or availability depending on the gadget chain present.
Practical consequences include exposure of internal data or content and an increased risk of targeted phishing or social engineering if email addresses or other user metadata are accessed. The issue does not automatically imply full site takeover unless a compatible POP chain is present, but the presence of additional vulnerable components raises the potential impact.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributors and Subscribers where possible.
- Enforce strong passwords and enable two-factor authentication for Editors and Administrators.
- Remove unused or unmaintained plugins and themes to reduce the chance of gadget chains being present.
- Monitor site activity and logs for unusual behavior, including unexpected AJAX requests and changes to files or critical settings.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
