CVE-2026-49105: WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a critical vulnerability in the WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms WordPress plugin (versions up to and including 1.1.4). The flaw is reachable over the network with no authentication required, meaning any remote visitor can send a crafted payload to trigger deserialization of attacker-controlled PHP objects. Depending on what other code (gadget chains) is present in the WordPress installation, successful exploitation enables full remote code execution, arbitrary file manipulation, or data theft. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation to deliver a malicious payload.

• AuthenticationNot required

  No account or session credential is needed; the injection point is reachable by any unauthenticated visitor.

• Victim interactionNot required

  The attacker interacts directly with the server-side endpoint and does not need any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploit reliability is high and no special preconditions are needed, though achieving full code execution may depend on the presence of a usable PHP gadget chain in the target installation.

Blast Radius

• Reads arbitrary files and database contents accessible to the web server process, including WordPress credentials, API keys, and stored form data.
• Modifies or deletes files and database records, allowing an attacker to plant backdoors, alter site content, or destroy data.
• Executes arbitrary operating-system commands on the host if a suitable PHP gadget chain is available, giving the attacker full control of the container or server.
• Crashes or destabilizes the WordPress application by triggering destructors in the deserialized object graph, causing service disruption.