CVE-2026-87741 Overview
The ConvertPlus plugin for WordPress contains a PHP Object Injection vulnerability in all versions up to and including 3.6.3. The flaw resides in the cp_display_preview_modal AJAX action, where the style parameter is passed through sanitize_text_field() and concatenated into a shortcode string executed by do_shortcode(). Because sanitize_text_field() does not strip shortcode delimiters, an authenticated attacker with Subscriber-level access can inject a secondary [smile_modal] invocation. That secondary shortcode reaches smile_modal_popup(), which passes base64-decoded attacker input to maybe_unserialize() without an allowed_classes restriction, enabling arbitrary object instantiation.
Critical Impact
When a POP chain exists in another installed plugin or theme, exploitation can lead to arbitrary file deletion, sensitive data disclosure, or remote code execution.
Affected Products
- ConvertPlus (ConvertPro) plugin for WordPress
- All versions up to and including 3.6.3
- WordPress sites where any Subscriber-or-higher account can be registered
Discovery Timeline
- 2026-09-28 - CVE-2026-87741 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-87741
Vulnerability Analysis
The vulnerability chains together several distinct weaknesses in the cp_display_preview_modal AJAX handler. The nonce guard uses an isset() check on the cp_admin_page_nonce parameter, so omitting the parameter entirely bypasses validation. The callback also performs no current_user_can() capability check, granting Subscriber-level accounts equivalent access to administrators for this endpoint.
The attacker-supplied style value is sanitized only with sanitize_text_field(), which strips control characters and tags but preserves [ and ]. When the sanitized value is concatenated into a shortcode template and evaluated by do_shortcode(), a second [smile_modal] shortcode can be injected. The smile_modal_popup() handler for that shortcode base64-decodes attribute data and passes the resulting bytes to maybe_unserialize() without setting allowed_classes => false, permitting PHP object instantiation on the target.
The base plugin does not ship a Property-Oriented Programming (POP) chain, so exploitation depends on gadgets provided by other installed plugins or themes. On sites with vulnerable third-party gadget chains, the object injection can escalate to arbitrary file operations or code execution.
Root Cause
The root cause is unsafe deserialization of untrusted input combined with an incomplete nonce guard and a missing capability check. sanitize_text_field() is not a shortcode-safe sanitizer, and maybe_unserialize() was invoked without restricting allowed classes, violating WordPress hardening guidance issued after CVE-2017-9841-class findings. The relevant weakness classification is [CWE-502: Deserialization of Untrusted Data].
Attack Vector
An authenticated attacker holding a Subscriber account sends a POST request to admin-ajax.php with action=cp_display_preview_modal, omits cp_admin_page_nonce, and supplies a style value containing a crafted [smile_modal] shortcode whose base64-encoded attribute carries a serialized PHP object. When the server evaluates do_shortcode(), the injected shortcode fires smile_modal_popup(), which deserializes the attacker's payload and instantiates the object graph in the WordPress process.
Detection Methods for CVE-2026-87741
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=cp_display_preview_modal and no cp_admin_page_nonce parameter.
- style parameter values that contain [smile_modal or URL-encoded shortcode delimiters (%5Bsmile_modal).
- Base64-encoded blobs in shortcode attributes that decode to serialized PHP structures beginning with O: or a:.
- Unexpected PHP fatal errors referencing __wakeup, __destruct, or autoloaded classes from unrelated plugins immediately after the AJAX call.
Detection Strategies
- Alert on WordPress AJAX requests targeting cp_display_preview_modal originating from low-privilege sessions.
- Inspect web server logs for style= parameters containing shortcode brackets or long base64 payloads.
- Correlate Subscriber-tier authentication events with subsequent file writes, plugin option changes, or new PHP file creation under wp-content.
Monitoring Recommendations
- Monitor creation and modification of files in wp-content/uploads, wp-content/plugins, and wp-content/themes following ConvertPlus AJAX traffic.
- Track new or elevated user accounts and unexpected changes to wp_options entries such as active_plugins and siteurl.
- Enable PHP error logging and forward WordPress debug.log entries into a central data lake for retrospective hunting.
How to Mitigate CVE-2026-87741
Immediate Actions Required
- Update ConvertPlus to a version later than 3.6.3 as soon as the vendor releases a fix; consult the Wordfence Vulnerability Report for the fixed version.
- Disable open user registration or restrict the Subscriber role until the plugin is patched.
- Audit installed plugins and themes for known POP gadget chains and remove any that are unmaintained.
Patch Information
Refer to the vendor at ConvertPro Official Site and the Wordfence Vulnerability Report for the current fixed release. Apply the update through the WordPress plugin manager or via WP-CLI (wp plugin update convertplug).
Workarounds
- Deactivate the ConvertPlus plugin until a patched version is installed.
- Deploy a Web Application Firewall (WAF) rule blocking POST requests to admin-ajax.php where action=cp_display_preview_modal and the style parameter contains [ or ].
- Enforce least privilege by removing unused Subscriber accounts and disabling users_can_register in wp-options.
# Configuration example: disable open registration and remove the plugin
wp option update users_can_register 0
wp plugin deactivate convertplug
wp plugin delete convertplug
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
