CVE-2026-49105

Name of the Vulnerable Software and Affected Versions WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms versions prior to 1.1.5

Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to pass a specially crafted object into the application. While no Property Oriented Programming (POP) chain—a sequence of gadgets used to execute arbitrary code—is present in the software itself, the presence of a POP chain in another installed plugin or theme could enable an unauthenticated attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 1.1.4.