tag
Php-Object-Injection
GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)
CVE-2025-22777 is an unauthenticated PHP Object Injection (CWE-502, Deserialization of Untrusted Data) vulnerability in the GiveWP WordPress donation plugin. GiveWP stores certain donor-supplied form field values as serialized PHP meta in the database and…
WP Zendesk for Contact Form 7 Unauthenticated PHP Object Injection (CVE-2026-49105)
This PoC targets the WP Zendesk for Contact Form 7 plugin, whose cf7-zendesk.php calls maybeunserialize() on user-supplied Contact Form 7 field values without validation. An unauthenticated attacker can locate a site's CF7 forms via the CF7 REST API (or by…
WP Insightly Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49085)
This PoC targets the WP Insightly plugin, which calls PHP's maybeunserialize() on user-supplied form field values without validating the input. An unauthenticated attacker can submit a crafted PHP serialized object as a form field value through the plugin's…
WP Activity Log Unauthenticated PHP Object Injection — CVE-2026-54806
WP Activity Log logs the User-Agent header on any request that generates a loggable event (such as a failed login), and stores that value in the database without treating it as untrusted input. The stored value is later deserialized (via PHP's native…
SP LMS PHP Object Injection → Unauthenticated RCE (CVE-2026-48909)
SP LMS's cart model (components/comsplms/models/cart.php) reads the lmsOrders cookie, base64-decodes it, and passes the result directly to PHP's unserialize() with no validation, giving an unauthenticated attacker full control over the deserialized object…
Integration for Keap/Infusionsoft Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49104)
This PoC targets the "Integration for Keap/Infusionsoft" WordPress plugin, whose cf7-infusionsoft.php file calls maybeunserialize() on user-supplied form field values without validation. An unauthenticated attacker can submit a crafted PHP serialized object…
Integration for ActiveCampaign Unauthenticated PHP Object Injection via Unsafe Deserialization (CVE-2026-9691)
The plugin's cf7-active-campaign.php component calls PHP's maybeunserialize() on user-supplied form field values without validation before forwarding them to ActiveCampaign. An unauthenticated attacker can submit a crafted, serialized PHP object as a form…
Everest Forms Unauthenticated PHP Object Injection to RCE (CVE-2026-3296)
Everest Forms saves submitted form field values into the wpevfentrymeta table using maybeserialize(), and its sanitization routine (sanitizetextfield()) strips HTML/null bytes but does not strip PHP serialization control characters, so an attacker can submit…
Unauthenticated RCE in Mirasvit Full Page Cache Warmer for Magento 2 (CVE-2026-45247)
CVE-2026-45247 is a PHP object injection / insecure deserialization vulnerability in Mirasvit's Full Page Cache Warmer extension for Magento 2. The extension processes attacker-controlled data from the CacheWarmer cookie and passes it directly to PHP's native…