CVE-2026-49768
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Happyforms versions up to 1.26.13 are vulnerable to unauthenticated PHP object injection.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized code, potentially leading to serious security breaches.
Recommendation
It is recommended to update to the latest version of Happyforms to mitigate this vulnerability.
Other vulnerabilities in Happyforms
See all- CVE-2026-97065High
Unauthenticated XSS attack in Happyforms plugin up to version 1.26.15. An attacker can inject malicious script without authentication.
- CVE-2025-11977Medium
The Happyforms plugin for WordPress up to version 1.26.12 is vulnerable to Local File Inclusion (LFI) via the happyforms_get_form_partial() function. This allows authenticated attackers with Administrator-level access or higher to include and execute arbitrary .php files on the server.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS