What is the CVSS score of CVE-2026-49085?

CVE-2026-49085 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WP Insightly are affected by CVE-2026-49085?

The WP Insightly plugin for WordPress (versions 1.1.4 and earlier) contains a critical unauthenticated remote code execution vulnerability that requires no user interaction or credentials to exploit.

How to fix or mitigate CVE-2026-49085?

Within 24 hours: Inventory all WordPress installations using WP Insightly plugin version 1.1.4 or earlier and disable the plugin immediately. Conduct forensic review of server logs and database for signs of exploitation targeting /wp-json/ endpoints or serialization attacks. Within 7 days: Completely remove the plugin from all systems; audit database for injected code or modified content; review user activity logs for unauthorized access. Within 30 days: Monitor vendor advisory channels for a patched version; implement application-layer firewall rules to block serialization patterns; establish mandatory plugin version verification in deployment procedures.

WP Insightly CVE-2026-49085

EUVD-2026-36880 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-mcfw-4jg7-v278

PHP Deserialization Wp Insightly For Contact Form 7 Wpforms Elementor Formidable And Ninja Forms Elementor

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable WordPress plugin endpoint deserializes attacker input, yielding full RCE with high C/I/A impact and no user interaction or privileges required.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:35 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

Articles & Coverage 1

News Critical PHP Object Injection in WP Insightly Contact Form Plugin <= 1.1.4 - CVE-2026-49085 Jun 15, 2026

AnalysisAI

Unauthenticated PHP object injection in the WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms WordPress plugin (versions <= 1.1.4) allows remote attackers to deliver crafted serialized payloads that the plugin deserializes without validation. Successful exploitation can lead to remote code execution, data tampering, or full site compromise when a suitable POP (property-oriented programming) gadget chain is available in WordPress core, the active theme, or any installed plugin. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-502 (Deserialization of Untrusted Data) issue in a CRM Perks WordPress plugin that bridges popular form builders (Contact Form 7, WPForms, Elementor Forms, Formidable Forms, Ninja Forms) with the Insightly CRM. The CPE cpe:2.3:a:crm_perks:wp_insightly_for_contact_form_7,_wpforms,_elementor,_formidable_and_ninja_forms covers all releases up to and including 1.1.4. PHP object injection occurs when user-controlled input reaches PHP's unserialize() (or equivalent) function; on instantiation, magic methods such as __wakeup, __destruct, or __toString fire and can be abused via a POP chain to execute arbitrary code, write files, or query the database. Because WordPress and many popular plugins ship classes with reachable magic methods, even a 'gadget-less' plugin like this one is typically exploitable in real deployments.

RemediationAI

Patch available per vendor advisory: upgrade the WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin to a version newer than 1.1.4 as soon as CRM Perks publishes a fixed release, verifying the exact patched version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-insightly/vulnerability/wordpress-wp-insightly-for-contact-form-7-wpforms-elementor-formidable-and-ninja-forms-plugin-1-1-4-php-object-injection-vulnerability and the plugin's WordPress.org page. If immediate patching is not possible, deactivate and remove the plugin until a fix is available (this loses Insightly CRM integration for form submissions but eliminates the vulnerable code path), or place a WAF rule (e.g., Patchstack, Wordfence, Cloudflare) in front of WordPress that blocks request parameters containing PHP serialized object markers such as O:<digits>: and a:<digits>:{ on plugin endpoints - note this may produce false positives on legitimate serialized payloads and must be tuned. Restrict outbound network access from the web server to limit second-stage payloads, and review the wp-content, uploads and database for indicators of compromise such as unexpected admin users, modified plugin/theme files, or new scheduled tasks.