Executive brief
A security vulnerability exists in a popular WordPress plugin used to connect website forms (like Contact Form 7 and WPForms) with Mailchimp. This flaw allows an unauthenticated attacker to remotely take control of the website or access sensitive data without needing any login credentials. If exploited, this could lead to a total site takeover, data theft, or the site being used to spread malware.
Technical details
The 'Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms' plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 1.1.8. The vulnerability arises from the improper deserialization of user-supplied input (CWE-502), allowing an unauthenticated attacker to inject malicious PHP objects. If a suitable Property-Oriented Programming (POP) chain is present on the server, this can lead to remote code execution, SQL injection, or unauthorized file access. The attack can be carried out over the network without any user interaction. A patch is available in version 1.1.9.
Affected products
- WPPit Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8
Timeline
- 2025-05-17: other: Vulnerability reported by researcher Frissi0n
- 2026-06-04: patched: Version 1.1.9 released to address the issue
- 2026-06-15: disclosed: CVE published to NVD