Is CVE-2026-49781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49781 being exploited in the wild.

How severe is CVE-2026-49781?

Critical severity, with a CVSS score of 9.8, published 15 June 2026.

Which products and versions are affected?

Brainstorm Force OttoKit (SureTriggers) <= 1.1.27.

Is there a fix for CVE-2026-49781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49781 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-49781?

Check whether you run Brainstorm Force OttoKit (SureTriggers) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49781: Brainstorm Force OttoKit PHP object injection

Q: Is there a fix for CVE-2026-49781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-49781 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-49781?

Check whether you run Brainstorm Force OttoKit (SureTriggers) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49781 · Severity: critical · CVSS 9.8 · Published 2026-06-15

OttoKit, a WordPress plugin used for automation and integration, contains a critical security flaw that allows unauthorized users to interfere with the site's internal data processing. By exploiting this vulnerability, an attacker could potentially take full control of the website, steal sensitive information, or disrupt services. This type of flaw is frequently targeted in automated mass-exploitation campaigns against WordPress sites.

Vendors: Brainstorm Force.

Quick answers

Is CVE-2026-49781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49781 being exploited in the wild.
How severe is CVE-2026-49781?: Critical severity, with a CVSS score of 9.8, published 15 June 2026.
Which products and versions are affected?: Brainstorm Force OttoKit (SureTriggers) <= 1.1.27.
Is there a fix for CVE-2026-49781?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49781 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-49781?: Check whether you run Brainstorm Force OttoKit (SureTriggers) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

OttoKit (formerly associated with SureTriggers) for WordPress is vulnerable to PHP Object Injection due to improper deserialization of user-supplied input (CWE-502). An unauthenticated remote attacker can exploit this by sending specially crafted input to the application. If a suitable Property-Oriented Programming (POP) chain is present in the environment, this can lead to remote code execution, arbitrary file deletion, or unauthorized database access. The vulnerability is patched in version 1.1.28.

Affected products

Brainstorm Force OttoKit (SureTriggers) <= 1.1.27

Timeline

2026-05-12: other: Reported by researcher daroo
2026-06-04: advisory: Initial advisory published by Patchstack
2026-06-15: disclosed: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-27-php-object-injection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.