VulnSocial

CVE-2026-9691Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (4 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 6 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • General: 1 classified signal
  • Peaked at 4 mentions on most recent observed day (2026-07-10)
  • 6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d
01234Mentions · 2026-06-14: 1Mentions · 2026-06-16: 1Mentions · 2026-07-10: 4PoC Mentioned / Linked · 2026-06-14: 1Technical Details · 2026-06-14: 1Technical Details · 2026-06-16: 1Technical Details · 2026-07-10: 206-1406-1607-10
Signal classification3 categories
Disclosure
466.7%
PoC
116.7%
General
116.7%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-141
PoC1
2026-06-161
Disclosure1
2026-07-104
Disclosure3General1
Full discourse6 posts
  • ZoomEye@zoomeye_team
    Disclosure

    🚨 CVE-2026-9691: WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability Critical Vulnerability Alert! Tornado is affected by CVE-2026-9691. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-9691 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-9691" Search Dork: app="Tornado" Exposure: 9.3m+ instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJUb3JuYWRvIg==&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260616 #Infosec #CyberSecurity #ZoomEye #DarkEye

    Post summary

    The text announces CVE‑2026‑9691, providing technical details about a PHP Object Injection flaw in certain WordPress plugins, links to an analysis page, and highlights exposed instances via ZoomEye. No exploitation proof, active attacks, or patch information are discussed.

    01403374.3K
    12.6K followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    Full Tweet 🚨 CVE-2026-9691: WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin &amp;lt;= 1.1.1 - PHP Object Injection vulnerability

    Post summary

    This tweet announces CVE-2026-9691, a PHP Object Injection flaw affecting several WordPress plugins up to version 1.1.1.

    1000059
    308 followersView on X
  • Lyrie.ai@lyrie_ai
    General

    Source: X search for CVE-2026 critical Posted: 2026-06-16T07:33:42.000Z Likes: 14 0day Intel: 🚨 CVE-2026-9691: WordPress Integration for ActiveCampaign and Contact Form 7, W

    Post summary

    A tweet briefly announces a new CVE affecting WordPress plugins but offers no further technical details, exploitation evidence, or remediation information.

    1000058
    308 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    0day Intel: 🚨 CVE-2026-9691: WordPress Integration for ActiveCampaign and Contact Form 7, W

    Post summary

    The post announces a zero‑day CVE-2026-9691 for WordPress integration with ActiveCampaign and Contact Form 7, but offers no further details or context.

    1000051
    308 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    CVE-2026-9691: 🚨 CVE-2026-9691: WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin &amp;lt;= 1.1.1 - PHP Object Injection vulnerability Critical Vulnerability Alert! Tornado is affected by CVE-2026-9691. Full Vulnerability…

    Post summary

    A critical PHP Object Injection vulnerability (CVE-2026-9691) affecting WordPress integration plugins up to version 1.1.1 has been disclosed, with no PoC, exploit code, patch, or evidence of active exploitation provided.

    1000065
    308 followersView on X
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-9691-cf7-active-campaign-version-1-1-1-high-vulnerability-proof-of-concept CVE-2026-9691 cf7-active-campaign (CVSS Score 8.1) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #at…

    Post summary

    A proof‑of‑concept for CVE‑2026‑9691, a high‑severity vulnerability affecting the WordPress plugin cf7‑active‑campaign, is presented on the Atomicedge website.

    0000040
    9 followersView on X

Explore more

Back to dashboard