# CVE-2026-49781: Brainstorm Force OttoKit PHP object injection

Source: https://junglewise.ai/threats/cve-2026-49781-brainstorm-force-ottokit-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-49781 · Severity: critical · CVSS 9.8 · Published 2026-06-15

OttoKit, a WordPress plugin used for automation and integration, contains a critical security flaw that allows unauthorized users to interfere with the site's internal data processing. By exploiting this vulnerability, an attacker could potentially take full control of the website, steal sensitive information, or disrupt services. This type of flaw is frequently targeted in automated mass-exploitation campaigns against WordPress sites.

Vendors: [Brainstorm Force](https://junglewise.ai/threats/vendors/brainstorm-force).

## Quick answers

**Is CVE-2026-49781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49781 being exploited in the wild.

**How severe is CVE-2026-49781?** Critical severity, with a CVSS score of 9.8, published 15 June 2026.

**Which products and versions are affected?** Brainstorm Force OttoKit (SureTriggers) <= 1.1.27.

**Is there a fix for CVE-2026-49781?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49781 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-49781?** Check whether you run Brainstorm Force OttoKit (SureTriggers) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OttoKit (formerly associated with SureTriggers) for WordPress is vulnerable to PHP Object Injection due to improper deserialization of user-supplied input (CWE-502). An unauthenticated remote attacker can exploit this by sending specially crafted input to the application. If a suitable Property-Oriented Programming (POP) chain is present in the environment, this can lead to remote code execution, arbitrary file deletion, or unauthorized database access. The vulnerability is patched in version 1.1.28.

## Affected products

- Brainstorm Force OttoKit (SureTriggers) <= 1.1.27

## Timeline

- 2026-05-12: other: Reported by researcher daroo
- 2026-06-04: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-27-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-27-php-object-injection-vulnerability?_s_id=cve)