CVE-2026-49104: WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-supplied data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary PHP objects and potentially chain them into code execution. The affected product is the WordPress plugin "Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms" by CRM Perks, versions up to and including 1.2.1. This vulnerability is reachable over the network with no authentication required and no user interaction needed, and successful exploitation gives an attacker full read, write, and availability impact on the affected host. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS from any internet-connected location.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by an anonymous, unauthenticated HTTP request.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user needs to click a link or take any action.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special preconditions such as race conditions or knowledge of environment-specific values.

Blast Radius

• A successful attacker can read arbitrary files and data accessible to the web server process, including WordPress database credentials and stored customer records.
• The attacker can write or modify files on the server, enabling persistent backdoors or defacement of site content.
• PHP object injection chains (POP chains) present in the WordPress environment can be leveraged to achieve remote code execution on the host.
• The attacker can crash or disrupt the WordPress service, causing denial of availability for the site and any integrated Keap/Infusionsoft form workflows.