Is CVE-2026-87741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87741 being exploited in the wild.

How severe is CVE-2026-87741?

High severity, with a CVSS score of 8.8, published 28 September 2026.

Which products and versions are affected?

Brainstorm Force ConvertPlus up to and including 3.6.3.

Is there a fix for CVE-2026-87741?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87741 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87741?

Check whether you run Brainstorm Force ConvertPlus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87741: ConvertPlus plugin for WordPress unsafe deserialization in AJAX

CVE-2026-87741 · Severity: high · CVSS 8.8 · Published 2026-09-28

The ConvertPlus plugin for WordPress, a lead generation tool used to create opt-in forms and popups, contains a vulnerability in its AJAX functionality that allows subscriber-level users to inject malicious PHP objects. While the plugin itself does not execute code from these objects, an attacker who controls an installed theme or another plugin could exploit this to achieve arbitrary file deletion, data theft, or code execution on the WordPress site.

Vendors: Brainstorm Force.

Quick answers

Is CVE-2026-87741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87741 being exploited in the wild.
How severe is CVE-2026-87741?: High severity, with a CVSS score of 8.8, published 28 September 2026.
Which products and versions are affected?: Brainstorm Force ConvertPlus up to and including 3.6.3.
Is there a fix for CVE-2026-87741?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87741 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87741?: Check whether you run Brainstorm Force ConvertPlus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The cp_display_preview_modal AJAX action fails to properly validate the nonce parameter (checking with isset() rather than verification), performs no capability check, and passes unsanitized data through do_shortcode() which allows shortcode injection. An authenticated subscriber can craft a malicious serialized PHP object that bypasses sanitize_text_field() and is deserialized without restricting allowed classes, achieving arbitrary object injection if a POP chain exists in another installed plugin or theme.

Affected products

Brainstorm Force ConvertPlus up to and including 3.6.3

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.