What is the CVSS score of CVE-2026-49104?

CVE-2026-49104 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Integration for Keap/Infusionsoft are affected by CVE-2026-49104?

The 'Integration for Keap/Infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' WordPress plugin (versions 1.2.1 and earlier) contains a critical unauthenticated vulnerability…

How to fix or mitigate CVE-2026-49104?

Within 24 hours: Inventory all WordPress instances and identify those running the affected plugin at version 1.2.1 or earlier; immediately disable the plugin on all affected sites. Within 7 days: Remove the plugin entirely or, if a patched version is released, verify and upgrade to the latest secure version; conduct security audit for unauthorized administrative accounts or malicious modifications. Within 30 days: Implement Web Application Firewall rules to block PHP serialization attack patterns; review access logs for indicators of compromise and establish continuous monitoring for plugin updates.

Integration for Keap/Infusionsoft CVE-2026-49104

EUVD-2026-36881 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-8cgq-qh5g-cj52

PHP Deserialization Integration For Keap Infusionsoft And Contact Form 7 Wpforms Elementor Formidable Ninja Forms Elementor

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated PHP object injection reachable over HTTP with no user interaction; deserialization gadget chains typically yield full RCE, justifying H across CIA.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:35 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

Articles & Coverage 1

News Critical PHP Object Injection in WordPress Keap/Infusionsoft Integration Plugin - CVE-2026-49104 Jun 16, 2026

AnalysisAI

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' (versions 1.2.1 and earlier) allows remote attackers to inject crafted serialized objects that can be deserialized by the plugin, potentially leading to full site compromise. No public exploit identified at time of analysis, but the CVSS 9.8 score and unauthenticated network attack vector make this a high priority for any WordPress site running the affected plugin. EPSS and CISA KEV data were not provided in the input, so real-world exploitation prevalence is undetermined.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) within a PHP-based WordPress plugin produced by CRM Perks (per CPE cpe:2.3:a:crm_perks:integration_for_keap/infusionsoft_and_contact_form_7,_wpforms,_elementor,_formidable,_ninja_forms). PHP object injection occurs when user-controlled input is passed to unserialize() without validation, allowing an attacker to instantiate arbitrary PHP classes and trigger their magic methods (__wakeup, __destruct, __toString). When chained with so-called 'POP gadgets' present in WordPress core, other installed plugins, or Composer dependencies, this primitive typically escalates to arbitrary file write, SQL injection, or remote code execution on the underlying PHP host.

RemediationAI

Upstream fix available per the Patchstack advisory; released patched version is not explicitly stated in the provided data, so administrators should upgrade to the latest available release of the cf7-infusionsoft plugin (any version greater than 1.2.1) as published in the WordPress plugin directory and verify the installed version via the WordPress admin dashboard. If patching cannot be performed immediately, deactivate and remove the plugin entirely - given that integration plugins are not on the request hot path, removal has limited functional impact aside from loss of Keap/Infusionsoft form forwarding. Compensating controls include placing a WAF rule in front of WordPress that blocks request bodies containing PHP-serialized payload markers (e.g., 'O:', 'a:N:{') on the plugin's endpoints, noting that this can produce false positives on legitimate form data, and restricting wp-admin and plugin AJAX endpoints by IP allowlist where feasible. Reference the vendor advisory at https://patchstack.com/database/wordpress/plugin/cf7-infusionsoft/vulnerability/wordpress-integration-for-keap-infusionsoft-and-contact-form-7-wpforms-elementor-formidable-ninja-forms-plugin-1-2-1-php-object-injection-vulnerability for confirmation of the fixed version once published.