CVE-2026-49768: WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated remote code execution class of vulnerability affecting the Happyforms WordPress plugin at version 1.26.13 and below. The flaw is reachable over the network with no login required and no user interaction, meaning any internet-facing WordPress site with the plugin installed is exposed. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected site. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress site.

• AuthenticationNot required

  No account or session credential of any kind is needed to trigger the injection.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• A successful attacker can read any data accessible to the web process, including WordPress database credentials, stored user records, and session tokens.
• The attacker can write or modify files and database rows, enabling backdoor installation, content defacement, or privilege escalation within WordPress.
• The attacker can crash or hang the web service process, taking the WordPress site offline.
• Because PHP Object Injection can chain existing class constructors (POP chains), the practical outcome is arbitrary code execution on the host running the plugin.