Executive Summary

This vulnerability is an unauthenticated PHP Object Injection affecting the WP Insightly plugin for several WordPress form plugins including Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms versions up to 1.1.4.

PHP Object Injection occurs when an attacker is able to inject a serialized PHP object into an application, which can then be deserialized and executed, potentially leading to remote code execution or other malicious actions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability has a very high severity with a CVSS score of 9.8, indicating it can have a critical impact.

• An attacker can exploit this vulnerability remotely without any authentication.
• Successful exploitation can lead to full compromise of the affected system, including complete confidentiality, integrity, and availability loss.
• Potential impacts include remote code execution, data theft, data manipulation, and denial of service.

Useful 0 Not Useful 0