EUVD-2026-36891
GHSA-c8fc-9hj8-3f9p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization in a WordPress plugin; PHP Object Injection typically enables full CIA compromise via gadget chains, so AV:N/AC:L/PR:N/UI:N with C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
AnalysisAI
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to deliver attacker-controlled serialized objects that get deserialized by the plugin, potentially leading to remote code execution, file manipulation, or data compromise on the underlying WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network attack vector make this a high-priority issue for any site running the plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Target site must have the Happyforms WordPress plugin installed and active at version 1.26.13 or earlier, with the vulnerable submission endpoint reachable from the attacker's network (typical for any public-facing WordPress site using Happyforms). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) signals the worst-case scenario: remote, unauthenticated, low-complexity exploitation with full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Happyforms <= 1.26.13 (fingerprintable via page source, REST endpoints, or plugin enumeration) and sends a crafted HTTP request to a Happyforms-handled endpoint containing a serialized PHP payload. The payload deserializes into a POP gadget chain drawn from WordPress core or other installed plugins, triggering arbitrary file write, SQL execution, or command execution as the PHP/web-server user, leading to site takeover. … |
| Remediation | Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided input - administrators should upgrade Happyforms to the latest version released after 1.26.13 by checking the plugin page on wordpress.org or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/happyforms/vulnerability/wordpress-happyforms-plugin-1-26-13-php-object-injection-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable or remove Happyforms plugin immediately from all WordPress installations running version 1.26.13 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Unauthenticated PHP Object Injection in the WordPress plugin Integration for Contact Form 7 and Constant Contact (versio
Share
External POC / Exploit Code
Leaving vuln.today