Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 - Unauthenticated PHP Object Injection

This research plan outlines the steps required to analyze and demonstrate the Unauthenticated PHP Object Injection vulnerability in the Happyforms plugin (CVE-2026-49768).

1. Vulnerability Summary

The Happyforms plugin is vulnerable to PHP Object Injection due to the use of maybe_unserialize() on untrusted user input. Specifically, the function happyforms_get_message_part_value() in core/helpers/helper-misc.php attempts to unserialize field values submitted by users. If a form is configured to display submitted values in a confirmation message or email, an unauthenticated attacker can provide a serialized PHP object in a form field, which will be executed during the submission processing phase.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: happyforms_submit (typically registered as wp_ajax_nopriv_happyforms_submit)
• Vulnerable Parameter: Any form field parameter (e.g., happyforms_field_123)
• Authentication: None (Unauthenticated)
• Preconditions: A Happyforms form must be published on a page, and its "Success Message" or confirmation settings must be configured to process or display the submitted values (triggering the sink).

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with action=happyforms_submit.
2. Processing: The submission controller (likely HappyForms_Submission_Controller) handles the request.
3. Sink Path: To generate a response or send notification emails, the plugin processes the submitted field values.
4. Vulnerable Function: It calls happyforms_get_message_part_value( $value, ... ) in core/helpers/helper-misc.php.
5. Execution: Inside happyforms_get_message_part_value():

   if ( is_string( $value ) ) {
       $value = maybe_unserialize( $value ); // <--- VULNERABILITY
   }
   

   If $value starts with O:, a:, s:, etc., maybe_unserialize will attempt to reconstruct the PHP object, triggering __wakeup() or __destruct() methods if a POP chain is available.

4. Nonce Acquisition Strategy

Happyforms protects its submission endpoint with a WordPress nonce.

• Nonce Action: happyforms_submit (or similar, verify in source).
• Localization: The nonce is localized in the happyforms_settings JavaScript object.
• Extraction Steps:
  1. Find a page containing a Happyforms form.
  2. Navigate to the page using browser_navigate.
  3. Extract the nonce and the form ID using browser_eval:

     // Example extraction
     const settings = window.happyforms_settings;
     return {
         nonce: settings.ajax_nonce,
         form_id: document.querySelector('input[name="happyforms_form_id"]')?.value
     };
     

5. Exploitation Strategy

1. Reconnaissance: Visit the target site and find a page with a form. Note the form_id and field names (e.g., happyforms_6, happyforms_7).
2. Payload Generation: Create a serialized PHP object payload. Since no internal POP chain is identified, use a generic object to test for deserialization (e.g., O:8:"stdClass":0:{}).
3. Submission: Use the http_request tool to send the payload.
   • Method: POST
   • URL: http://<target>/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=happyforms_submit&
     happyforms_form_id=<FORM_ID>&
     _wpnonce=<NONCE>&
     <FIELD_NAME>=O:8:"stdClass":0:{}&
     ... (other required fields)
     

4. Trigger: Ensure