What is the CVSS score of CVE-2026-49106?

CVE-2026-49106 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Integration for Contact Form 7 and Constant Contact are affected by CVE-2026-49106?

A critical unauthenticated remote code execution vulnerability affects the WordPress plugin 'Integration for Contact Form 7 and Constant Contact' (versions 1.1.6 and earlier), exposing any affected…

How to fix or mitigate CVE-2026-49106?

Within 24 hours: Audit all WordPress environments to identify deployed instances and versions of 'Integration for Contact Form 7 and Constant Contact'; immediately disable the plugin to prevent exploitation; review access logs for suspicious plugin-directed traffic. Within 7 days: Complete remediation by removing the plugin entirely or applying a vendor patch (monitor vendor advisory channels), and conduct forensic review of web server logs and database activity for evidence of unauthorized access or file modifications. Within 30 days: Procure and deploy an alternative contact form solution, verify its security posture through vulnerability scanning, and document lessons learned for plugin procurement procedures.

Integration for Contact Form 7 and Constant Contact CVE-2026-49106

EUVD-2026-36883 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-6jc2-r4qg-63mf

PHP Deserialization Integration For Contact Form 7 And Constant Contact

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable WordPress endpoint (AV:N/PR:N/UI:N), straightforward serialized payload (AC:L); deserialization with gadget chain typically yields full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:34 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the WordPress plugin Integration for Contact Form 7 and Constant Contact (versions <= 1.1.6) allows remote attackers to inject crafted serialized PHP objects that get deserialized server-side. When a suitable POP (property-oriented programming) gadget chain is present in WordPress core, another active plugin, or a theme, this can escalate to arbitrary file read/write, deletion, or remote code execution on the host. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects the unauthenticated network-reachable attack surface.

Technical ContextAI

The affected product is a WordPress plugin (CPE cpe:2.3:a:crm_perks:integration_for_contact_form_7_and_constant_contact) that bridges Contact Form 7 submissions to the Constant Contact email marketing API. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-influenced input into PHP's unserialize() (or an equivalent sink) without validating that the input contains only safe types. PHP deserialization is dangerous because instantiating objects triggers magic methods (__wakeup, __destruct, __toString), which can be chained into POP gadgets across the WordPress ecosystem to reach dangerous sinks like file_put_contents, system, or include.

RemediationAI

Released patched version not independently confirmed from the provided data - the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/cf7-constant-contact/vulnerability/wordpress-integration-for-contact-form-7-and-constant-contact-plugin-1-1-6-php-object-injection-vulnerability) should be consulted for the fixed release, and administrators should upgrade to any version above 1.1.6 published by CRM Perks. Until a confirmed fix is applied, deactivate the plugin if Constant Contact integration is non-essential (trade-off: form submissions will no longer sync to Constant Contact); alternatively, place the WordPress site behind a WAF with rules that block serialized PHP payloads (strings containing patterns like 'O:' or 'a:N:{') in request bodies and query strings to the plugin's endpoints, accepting the risk that bypasses against generic serialization filters are common. Restrict access to the affected plugin endpoints via IP allowlisting at the web server if feasible.