CVE-2026-9691: WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary PHP objects and trigger unintended code paths. This critical flaw affects the WordPress plugin "Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms" at version 1.1.1 and below, and is reachable over the network with no authentication required. Successful exploitation, combined with a suitable PHP gadget chain present in the environment, gives an attacker the ability to read, modify, or delete data and potentially execute arbitrary code on the host. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can reach it from the internet without requiring any foothold on the host.

• AuthenticationNot required

  No account or session credentials are needed; the injection can be triggered by an unauthenticated HTTP request.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a suitable PHP gadget chain is available in the WordPress environment, which is common given typical plugin ecosystems.

Blast Radius

• An attacker who triggers a usable gadget chain reads arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• A successful injection can modify or delete database rows, including user accounts, post content, and plugin settings.
• Depending on available gadgets, the attacker executes arbitrary operating system commands on the host running the WordPress container.
• All three outcomes (disclosure, tampering, and service disruption) carry a CVSS impact score of High, making full compromise of the affected container a realistic outcome.