CVE-2026-49106: WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability class where attacker-controlled data is passed to PHP's unserialize() function, allowing an attacker to instantiate arbitrary objects and potentially chain them into dangerous operations. The Integration for Contact Form 7 and Constant Contact WordPress plugin, version 1.1.6 and earlier, is affected and is reachable over the network with no authentication or user interaction required. Successful exploitation gives the attacker full read, write, and availability impact on the host, which in practice means remote code execution, data theft, or complete service disruption depending on what PHP classes are available in the runtime environment. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can send a crafted request from anywhere on the internet without requiring internal access.

• AuthenticationNot required

  No account or session credential of any privilege level is needed to trigger the unsafe deserialization call.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link, open a file, or take any other action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no race condition, special memory layout, or other environmental precondition beyond the plugin being installed and active.

Blast Radius

• Reads arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• Writes or modifies files on the server, enabling an attacker to plant a web shell or alter plugin and theme code.
• Executes arbitrary operating system commands if a suitable PHP gadget chain exists in the installed dependencies, giving full server-level control.
• Crashes or degrades the WordPress site by corrupting application state or consuming server resources.