What is the CVSS score of CVE-2026-49768?

CVE-2026-49768 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Happyforms are affected by CVE-2026-49768?

Happyforms WordPress plugin (versions 1.26.13 and earlier) contains a critical unauthenticated remote code execution vulnerability through PHP object injection that requires no user interaction.

How to fix or mitigate CVE-2026-49768?

Within 24 hours: Disable or remove Happyforms plugin immediately from all WordPress installations running version 1.26.13 or earlier. Within 7 days: Monitor Patchstack WordPress vulnerability database and Happyforms vendor advisories for patched versions; evaluate alternative form builder plugins. Within 30 days: Once a patched version is released and validated, upgrade to the latest version; if no patch is released within 30 days, transition to an alternative plugin solution.

Happyforms CVE-2026-49768

EUVD-2026-36891 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-c8fc-9hj8-3f9p

PHP Deserialization Happyforms

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization in a WordPress plugin; PHP Object Injection typically enables full CIA compromise via gadget chains, so AV:N/AC:L/PR:N/UI:N with C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:30 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to deliver attacker-controlled serialized objects that get deserialized by the plugin, potentially leading to remote code execution, file manipulation, or data compromise on the underlying WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network attack vector make this a high-priority issue for any site running the plugin. Reported by Patchstack with a corresponding advisory in their WordPress vulnerability database.

Technical ContextAI

Happyforms is a WordPress form-builder plugin distributed via the WordPress plugin ecosystem, identified by CPE cpe:2.3:a:happyforms:happyforms:*. The root cause is CWE-502 (Deserialization of Untrusted Data): PHP's unserialize() function reconstructs objects from a serialized string and invokes magic methods such as __wakeup, __destruct, and __toString during that process. When attacker-controlled input reaches unserialize(), an attacker can craft a 'POP chain' (Property-Oriented Programming chain) using gadget classes available in WordPress core, other active plugins, or the Happyforms plugin itself to trigger unintended code paths - commonly culminating in file write, file read, SQL injection, or arbitrary command execution depending on the gadgets present in the runtime.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided input - administrators should upgrade Happyforms to the latest version released after 1.26.13 by checking the plugin page on wordpress.org or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/happyforms/vulnerability/wordpress-happyforms-plugin-1-26-13-php-object-injection-vulnerability. If immediate patching is not possible, deactivate and remove the Happyforms plugin (forms will stop working, so plan a static fallback or alternative form provider), or place a WAF rule (e.g., Patchstack, Wordfence, or ModSecurity) in front of WordPress that blocks request bodies containing serialized PHP object patterns such as 'O:[0-9]+:"' and 'a:[0-9]+:{' on Happyforms endpoints - note this rule can produce false positives on legitimate forms accepting structured data and should be tested. Restrict access to wp-admin and the Happyforms submission endpoints by IP allowlist where the form is intended for internal users only.