Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection
Description
The Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.1.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HTechnical Details
<=1.1.1What Changed in the Fix
Changes introduced in v1.1.2
Source Code
WordPress.org SVN# Exploitation Research Plan - CVE-2026-9691 ## 1. Vulnerability Summary The **Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms** plugin (slug: `cf7-active-campaign`) is vulnerable to **Unauthenticated PHP Object Injection** in versions up to and including 1.1.1. T…
Show full research plan
Exploitation Research Plan - CVE-2026-9691
1. Vulnerability Summary
The Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin (slug: cf7-active-campaign) is vulnerable to Unauthenticated PHP Object Injection in versions up to and including 1.1.1. The vulnerability exists due to the use of maybe_unserialize() or unserialize() on untrusted input provided via POST parameters during form submissions. Specifically, the plugin's field-mapping logic allows an attacker to supply a serialized PHP object through a specific parameter (likely vxcf_activecamp_fields), which is processed when a form is submitted on the frontend.
2. Attack Vector Analysis
- Endpoint: Any public-facing page containing a form integrated with the plugin (e.g., Contact Form 7, WPForms, Elementor, or Ninja Forms).
- Target Hook:
wpcf7_before_send_mail(Contact Form 7),wpforms_process_entry_save(WPForms), orelementor_pro/forms/new_record(Elementor). - Vulnerable Parameter:
vxcf_activecamp_fields(inferred from the plugin IDvxcf_activecamp) orvxcf_form_fields(common in CRM Perks plugins). - Authentication: Unauthenticated (PR:N).
- Preconditions: The
Summary
The Integration for ActiveCampaign and Contact Form 7 plugin is vulnerable to unauthenticated PHP Object Injection due to the use of maybe_unserialize() on user-supplied form data. An attacker can exploit this by submitting a form with a crafted serialized PHP object in one of the fields, which can lead to remote code execution if a suitable POP chain is available on the site.
Vulnerable Code
// cf7-active-campaign.php around line 954 if(!is_array($value)){ $value=maybe_unserialize($value); }
Security Fix
@@ -952,7 +952,7 @@ $value=$value['value']; } if(!is_array($value)){ - $value=maybe_unserialize($value); + // $value=maybe_unserialize($value); } }
Exploit Outline
The exploit targets public-facing forms managed by Contact Form 7, WPForms, Elementor, or Ninja Forms when integrated with this plugin. An attacker identifies a form field that is processed by the ActiveCampaign integration logic (such as any mapped field). They submit a POST request to the form submission endpoint containing a serialized PHP object string as the value for that field. Because the plugin calls maybe_unserialize() on the value before transmission to ActiveCampaign, the object is instantiated. If the WordPress environment contains a usable POP chain (e.g., in other plugins or themes), the attacker can achieve remote code execution, file deletion, or sensitive data retrieval without authentication.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.