CVE-2026-49763: WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated remote code execution class of vulnerability affecting the Integration for Contact Form 7 HubSpot WordPress plugin at version 1.3.7 and earlier. The flaw is reachable over the network with no credentials required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can reach and trigger it from any internet-accessible host without any special network position.

• AuthenticationNot required

  No account or credentials of any privilege level are needed; the injection point is reachable by any unauthenticated request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is sent directly to the server.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• A successful attacker can execute arbitrary PHP code on the server, gaining full control of the WordPress application and its underlying host process.
• The attacker can read all data stored by the application, including contact form submissions, HubSpot API credentials, and WordPress database credentials.
• The attacker can modify or delete stored data, including posts, user accounts, plugin configurations, and any records accessible to the web process.
• The attacker can crash or render the affected service unavailable by corrupting application state or exhausting server resources.