WP-Safety
CVE-2026-49763

Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection

highDeserialization of Untrusted Data
8.1
CVSS Score
8.1
CVSS Score
high
Severity
1.3.8
Patched in
5d
Time to patch

Description

The Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.3.7 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
High
Confidentiality
High
Integrity
High
Availability

Technical Details

Affected versions<=1.3.7
PublishedJune 4, 2026
Last updatedJune 8, 2026
Affected plugincf7-hubspot

What Changed in the Fix

Changes introduced in v1.3.8

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v1.3.7
Browse source Download .zip
Patched v1.3.8
Browse source Download .zip
Research Plan
Unverified

# Exploitation Research Plan - CVE-2026-49763 ## 1. Vulnerability Summary The **Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms** plugin (versions <= 1.3.7) is vulnerable to **Unauthenticated PHP Object Injection**. The vulnerability exists because the plugin's form subm…

Show full research plan

Exploitation Research Plan - CVE-2026-49763

1. Vulnerability Summary

The Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms plugin (versions <= 1.3.7) is vulnerable to Unauthenticated PHP Object Injection. The vulnerability exists because the plugin's form submission handling logic retrieves a user-controlled POST parameter, base64-decodes it, and passes it directly to the unserialize() function without prior validation or sanitization. This allows an unauthenticated attacker to inject arbitrary PHP objects into the application scope.

2. Attack Vector Analysis

  • Endpoint: Any WordPress page containing a supported form (Contact Form 7, WPForms, etc.) or the AJAX submission endpoint for these plugins.
  • Hook: wpcf7_before_send_mail (for Contact Form 7), ninja_forms_after_submission (for Ninja Forms), wpforms_process_entry_save (for WPForms), and elementor_pro/forms/new_record (for Elementor).
  • Vulnerable Parameter: vxcf_p_data (POST parameter).
  • Authentication: Unauthenticated (available to any guest visitor).
  • Preconditions: A supported form must be active and accessible on the frontend.

3. Code Flow

  1. Registration: In cf7-hubspot.php, the vxcf_hubspot::setup_main()
Research Findings
Static analysis — not yet PoC-verified

Summary

The Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via the maybe_unserialize() function. This vulnerability allows an attacker to inject arbitrary PHP objects into the application scope during form submission processing, which can lead to remote code execution if a suitable POP chain is available in the environment.

Vulnerable Code

// cf7-hubspot.php around line 973
      $value=$value['value'];   
     }
     if(!is_array($value)){
          $value=maybe_unserialize($value);
     }

Security Fix

--- /home/deploy/wp-safety.org/data/plugin-versions/cf7-hubspot/1.3.7/cf7-hubspot.php	2025-03-20 10:16:26.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/cf7-hubspot/1.3.8/cf7-hubspot.php	2025-05-22 11:58:16.000000000 +0000
@@ -2,7 +2,7 @@
 /**
 * Plugin Name: WP Contact Form HubSpot
 * Description: Integrates Contact Form 7 and <a href="https://wordpress.org/plugins/contact-form-entries/">Contact Form Entries Plugin</a> and many other forms with HubSpot allowing form submissions to be automatically sent to your HubSpot account 
-* Version: 1.3.7
+* Version: 1.3.8
 * Requires at least: 3.8
 * Author URI: https://www.crmperks.com
 * Plugin URI: https://www.crmperks.com/plugins/contact-form-plugins/contact-form-hubspot-plugin/
@@ -25,7 +25,7 @@
   public  $crm_name = "hubspot";
   public  $id = "vxcf_hubspot";
   public  $domain = "vxcf-hubspot";
-  public  $version = "1.3.7";
+  public  $version = "1.3.8";
   public  $update_id = "6000001";
   public  $min_cf_version = "1.0";
   public $type = "vxcf_hubspot";
@@ -973,7 +973,7 @@
       $value=$value['value'];   
      }
      if(!is_array($value)){
-          $value=maybe_unserialize($value);
+         // $value=maybe_unserialize($value);
      }
   }else if(isset($_REQUEST[$field_id])){ 
     $value=$this->post($field_id);

Exploit Outline

To exploit this vulnerability, an unauthenticated attacker identifies a page on the target WordPress site that contains a form supported by the plugin (e.g., Contact Form 7 or WPForms). During the form submission process, the attacker includes a specially crafted payload in the POST parameter 'vxcf_p_data' (or other field parameters processed by the integration). This payload consists of a serialized PHP object, often base64-encoded depending on the specific form handler's path. When the plugin processes the submission, it passes the user-controlled input to maybe_unserialize(), triggering the instantiation of the injected object. If the target system has other plugins or themes installed that contain a usable POP chain, the attacker can leverage this to achieve remote code execution, delete files, or access sensitive data.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2fcad0-f948-4da5-9bb1-888fc0ced718?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database