Php-Object-Injection — PoC Archivehttps://poc.intelseclab.com/tags/php-object-injection/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Critical severity (CVSS 9.8) — web · CVE-2025-22777. Status: PoC. Affects: GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs). Tags: givewp, wordpress, wordpress-plugin, php-object-injection, deserialization, unserialize, gadget-chain, cwe-502, php, unauthenticated.webCriticalgivewpwordpresswordpress-pluginphp-object-injectiondeserializationunserializegadget-chaincwe-502phpunauthenticatedWP Zendesk for Contact Form 7 Unauthenticated PHP Object Injection (CVE-2026-49105)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49105-wp-zendesk-cf7-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49105-wp-zendesk-cf7-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49105. Status: PoC. Affects: WP Zendesk for Contact Form 7 plugin for WordPress, cf7-zendesk.php. Tags: wordpress, zendesk, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpresszendeskphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedWP Insightly Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49085)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49085-wp-insightly-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49085-wp-insightly-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49085. Status: PoC. Affects: WP Insightly (Contact Form 7 to Insightly CRM integration) plugin for WordPress, cf7-insightly.php. Tags: wordpress, insightly, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpressinsightlyphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedWP Activity Log Unauthenticated PHP Object Injection — CVE-2026-54806https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Critical severity (CVSS 9.8) — web · CVE-2026-54806. Status: PoC. Affects: WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress. Tags: wordpress, wp-activity-log, wp-security-audit-log, php-object-injection, deserialization, cwe-502, blind-rce, gadget-chain.webCriticalwordpresswp-activity-logwp-security-audit-logphp-object-injectiondeserializationcwe-502blind-rcegadget-chainSP LMS PHP Object Injection → Unauthenticated RCE (CVE-2026-48909)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Critical severity (CVSS 9.5) — web · CVE-2026-48909 (GHSA-gf8c-xmwj-whrh). Status: PoC. Affects: JoomShaper SP LMS (com_splms) Joomla Learning Management System extension. Tags: joomla, sp-lms, com_splms, php-object-injection, cwe-502, deserialization, unauthenticated-rce, gadget-chain.webCriticaljoomlasp-lmscom_splmsphp-object-injectioncwe-502deserializationunauthenticated-rcegadget-chainIntegration for Keap/Infusionsoft Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49104)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49104-keap-infusionsoft-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49104-keap-infusionsoft-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49104. Status: PoC. Affects: Integration for Keap/Infusionsoft (Contact Form 7 to Keap/Infusionsoft CRM integration) plugin for WordPress, cf7-infusionsoft.php. Tags: wordpress, keap, infusionsoft, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpresskeapinfusionsoftphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedIntegration for ActiveCampaign Unauthenticated PHP Object Injection via Unsafe Deserialization (CVE-2026-9691)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-9691. Status: PoC. Affects: "Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms" WordPress plugin. Tags: wordpress, contact-form-7, wpforms, elementor, ninja-forms, php-object-injection, deserialization, cwe-502, unauthenticated.webHighwordpresscontact-form-7wpformselementorninja-formsphp-object-injectiondeserializationcwe-502unauthenticatedEverest Forms Unauthenticated PHP Object Injection to RCE (CVE-2026-3296)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Critical severity (CVSS 9.8) — web · CVE-2026-3296. Status: PoC (functional two-phase injection/trigger tool; RCE requires supplying a real POP gadget chain via PHPGGC). Affects: Everest Forms (WordPress plugin — Contact Form, Payment Form, Quiz, Survey & Custom Form Builder). Tags: wordpress, everest-forms, php-object-injection, deserialization, unserialize, rce, cwe-502.webCriticalwordpresseverest-formsphp-object-injectiondeserializationunserializercecwe-502Unauthenticated RCE in Mirasvit Full Page Cache Warmer for Magento 2 (CVE-2026-45247)https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Critical severity (CVSS 9.3) — web · CVE-2026-45247. Status: Weaponized. Affects: Mirasvit Full Page Cache Warmer extension for Magento 2. Tags: php-object-injection, insecure-deserialization, RCE, Magento, Mirasvit, e-commerce, cookie-based, unauthenticated, CISA-KEV, active-exploitation.webCriticalphp-object-injectioninsecure-deserializationRCEMagentoMirasvite-commercecookie-basedunauthenticatedCISA-KEVactive-exploitation