What is the CVSS score of CVE-2026-49105?

CVE-2026-49105 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WP Zendesk are affected by CVE-2026-49105?

The CRM Perks WordPress plugin for Zendesk contact form integration (versions 1.1.4 and earlier) exposes any website using it to complete unauthenticated compromise through an attack requiring no…

How to fix or mitigate CVE-2026-49105?

Within 24 hours: Deactivate and disable the WP Zendesk plugin across all WordPress installations; document any business-critical workflows dependent on it. Within 7 days: Completely remove the plugin and migrate contact form functionality to an alternative solution (evaluate Gravity Forms, WPForms without vulnerable integrations, or native WordPress contact forms); deploy WAF rules to block PHP object injection patterns. Within 30 days: Conduct comprehensive audit of all installed WordPress plugins for similar critical vulnerabilities; establish automated plugin security scanning in your deployment pipeline; enforce a 24-hour response requirement for CVSS 9.0+ findings.

WP Zendesk CVE-2026-49105

EUVD-2026-36882 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-cr7j-78mh-rxpv

PHP Deserialization Wp Zendesk For Contact Form 7 Wpforms Elementor Formidable And Ninja Forms Elementor

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable PHP object injection in a WordPress plugin yields PR:N/UI:N/AV:N/AC:L; successful gadget-chain exploitation typically gives full code execution, justifying C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:34 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

Articles & Coverage 1

News Critical PHP Object Injection in WP Zendesk Contact Form Plugin - CVE-2026-49105 Jun 16, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the CRM Perks 'WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms' WordPress plugin (versions 1.1.4 and earlier) allows remote attackers to inject crafted serialized PHP objects into the application, potentially leading to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present. The flaw is reported by Patchstack and carries a 9.8 CVSS score with network-reachable, no-privilege, no-interaction characteristics. No public exploit identified at time of analysis.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data) within a PHP-based WordPress plugin that bridges several popular form builders (Contact Form 7, WPForms, Elementor Forms, Formidable Forms, Ninja Forms) with Zendesk. PHP Object Injection occurs when user-controllable input is passed to unserialize() or equivalent calls, allowing an attacker to instantiate arbitrary classes and trigger magic methods such as __wakeup, __destruct, or __toString. In a WordPress context this is typically chained with POP (Property-Oriented Programming) gadgets present in WordPress core or other installed plugins/themes to escalate from object instantiation into file write, SQL execution, or arbitrary code execution. The affected CPE is cpe:2.3:a:crm_perks:wp_zendesk_for_contact_form_7,_wpforms,_elementor,_formidable_and_ninja_forms covering all versions up to and including 1.1.4.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory only confirms that versions ≤ 1.1.4 are vulnerable. Site operators should monitor the WordPress.org plugin page and Patchstack advisory (https://patchstack.com/database/wordpress/plugin/cf7-zendesk/...) for a fixed release and upgrade as soon as one above 1.1.4 is published. In the interim, deactivate and remove the 'WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms' plugin entirely - this stops the Zendesk-to-form integration but eliminates the unauthenticated attack surface; if removal is not acceptable, place the site behind a WAF (e.g., Patchstack mitigation, Wordfence) with rules blocking serialized PHP payloads (strings beginning with O:, a:, s:, etc.) on the plugin's AJAX/REST endpoints, accepting that the WAF may also block legitimate edge cases and must be tuned. Restrict access to wp-admin and the plugin's endpoints by IP allowlist where feasible, and review logs for suspicious requests carrying serialized data.