{"uuid": "a1be8799-20f0-4327-93b0-f0c9a7225807", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15962", "type": "seen", "source": "https://gist.github.com/ichintu/6c425384b38fcad1e38e69c361a0752d", "content": "**CVE-2026-15962 \u2013 Fluent Forms Pro Add\u2011On Pack (\u2264\u202f6.2.6)**  \n- **Published:** July\u202f26\u202f2026  \n- **Issue:** PHP object injection via deserialization of untrusted input in all affected versions.  \n- **Impact:** Subscribers or higher can inject PHP objects; with the user\u2011update integration enabled and a mapped user\u2011meta field, attackers can trigger a protected object\u2011property (POP) chain to change any user\u2019s password, potentially taking over admin accounts.  \n- **Severity:** 8.8 (High)", "creation_timestamp": "2026-07-26T08:01:33.479959Z"}