What is the CVSS score of CVE-2026-49781?

CVE-2026-49781 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of OttoKit are affected by CVE-2026-49781?

OttoKit WordPress plugin versions 1.1.27 and earlier contain a critical vulnerability enabling unauthenticated remote code execution on any affected WordPress installation.

How to fix or mitigate CVE-2026-49781?

24 hours: Audit all WordPress installations for OttoKit (formerly SureTriggers) plugin presence and immediately deactivate and remove all versions up to 1.1.27 from production systems. 7 days: Identify and deploy alternative automation solution if required functionality; verify complete plugin removal from all WordPress instances and code repositories; document systems that hosted the plugin for forensic review. 30 days: Implement Web Application Firewall rules targeting PHP object deserialization attacks (CWE-502); conduct comprehensive post-incident security audit if plugin was active on production systems for any duration.

OttoKit CVE-2026-49781

EUVD-2026-36898 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-pf55-gh7m-56fg

PHP Deserialization Ottokit

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable PHP object injection with no user interaction; deserialization gadget chains routinely yield full code execution, giving C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:27 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the OttoKit WordPress plugin (formerly SureTriggers) versions 1.1.27 and earlier allows remote attackers to deserialize attacker-controlled PHP objects against any site running the plugin. With a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and a CWE-502 deserialization root cause, successful exploitation can lead to full code execution, data theft, or site takeover when a suitable POP gadget chain is present in WordPress core or another installed plugin. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

OttoKit (vendor: Brainstorm Force, CPE cpe:2.3:a:brainstorm_force:ottokit) is a WordPress automation/integration plugin - previously branded SureTriggers - that connects WordPress sites to external services and triggers workflows. The flaw is a CWE-502 Deserialization of Untrusted Data issue in PHP: attacker-supplied serialized data reaches a PHP unserialize() call (or equivalent), instantiating attacker-chosen classes and invoking their magic methods (__wakeup, __destruct, __toString). On a WordPress stack this typically becomes exploitable via POP (Property-Oriented Programming) gadget chains found in WordPress core, popular plugins, or libraries like Monolog/Guzzle, turning object injection into file write, SQLi, or RCE primitives.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version is not independently confirmed from the supplied input, so administrators should upgrade OttoKit to the latest version above 1.1.27 published by Brainstorm Force and verify the installed version under wp-admin → Plugins. Until the update is applied, compensating controls include deactivating the OttoKit/SureTriggers plugin entirely (trade-off: breaks any automation workflows it powers), restricting access to the plugin's REST/AJAX endpoints at the web server or WAF layer (risk of breaking legitimate trigger callbacks from external SaaS services), and deploying a virtual patch via Patchstack/Wordfence/managed-WAF rules that block serialized PHP payloads (O:, a:) on those endpoints. Refer to the advisory: https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-27-php-object-injection-vulnerability.