CVE-2026-49781: WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where an attacker supplies crafted serialized data that the application deserializes without validation, allowing arbitrary objects to be instantiated and their methods invoked. This critical flaw affects the OttoKit WordPress plugin by Brainstorm Force in all versions up to and including 1.1.27, and is reachable over the network with no authentication required. Successful exploitation can result in full confidentiality loss, data tampering, and service disruption on the affected WordPress installation. No fix version has been published; HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet or any network-adjacent position without requiring local access.

• AuthenticationNot required

  No account or session credential of any kind is needed; the injection vector is accessible to anonymous, unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the affected WordPress site.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, specific memory layout, or environmental prerequisite stands between the attacker and a working payload.

Blast Radius

• A successful attacker can read arbitrary data from the WordPress database and filesystem, including stored credentials, session tokens, and customer records.
• The attacker can modify or delete persisted database rows and site content, including posts, user accounts, and plugin configuration.
• The attacker can trigger a crash or render the WordPress site unavailable by instantiating objects that exhaust resources or corrupt application state.
• Because object injection can chain existing class methods (POP chains), the impact boundary can extend to remote code execution on the underlying server depending on which PHP classes are loaded in the environment.