CVE-2026-49085: WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, allowing arbitrary objects to be instantiated and potentially chained into code execution. The WP Insightly plugin for WordPress (versions 1.1.4 and earlier) contains this flaw and exposes it over the network with no authentication required. Successful exploitation can give an attacker full read, write, and availability impact on the WordPress installation. No fix version has been published; HarborGuard is tracking the advisory and will surface a patched rebuild as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is reachable over the network; an attacker can send a crafted HTTP request to any WordPress site running the plugin without prior access to the host.

• AuthenticationNot required

  No account or session credential is needed; the injection point is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need a site user to take any action; the exploit is triggered entirely by the attacker's own request.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or environmental prerequisites are required.

Blast Radius

• Reads arbitrary WordPress database content, including stored user credentials, session tokens, and private post data.
• Writes or modifies files and database rows on the server, enabling persistent backdoor installation or content tampering.
• Crashes or degrades the WordPress application, causing service disruption for site visitors.
• Achieves remote code execution by chaining PHP object gadgets present in the WordPress plugin ecosystem.