What is the CVSS score of CVE-2026-49109?

CVE-2026-49109 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-49109?

24 hours: Disable the plugin immediately via WordPress admin; audit server and WordPress logs for exploitation attempts (search for serialized object patterns in HTTP requests and PHP error logs). 7 days: Contact plugin vendor for patch availability and ETA; if unavailable, begin testing replacement form solutions (native WPForms, Formidable Forms, or Ninja Forms implementations). 30 days: Complete migration to patched plugin version or alternative form platform; deploy Web Application Firewall rules blocking PHP serialization patterns directed at /wp-content/plugins/ paths.

Integration for Salesforce CVE-2026-49109

EUVD-2026-36884 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-3vcv-283p-87rc

PHP Deserialization Integration For Salesforce And Contact Form 7 Wpforms Elementor Formidable Ninja Forms Elementor

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable WordPress plugin endpoint passes attacker input to unserialize(), enabling full CIA compromise via POP chain RCE with no user interaction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:33 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

AnalysisAI

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' (versions <= 1.4.3) allows remote attackers to pass attacker-controlled serialized data into PHP's unserialize() function. With a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and no authentication required, successful exploitation can lead to arbitrary code execution, data theft, or full site takeover when a suitable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) flaw in a WordPress plugin produced by CRM Perks (CPE cpe:2.3:a:crm_perks:integration_for_salesforce_and_contact_form_7,_wpforms,_elementor,_formidable,_ninja_forms). The plugin bridges multiple WordPress form builders (Contact Form 7, WPForms, Elementor Forms, Formidable, Ninja Forms) with Salesforce CRM. PHP Object Injection occurs when user-supplied input reaches unserialize() without validation; attackers craft serialized objects that, when reconstructed, invoke magic methods such as __wakeup() or __destruct() on classes loaded in the WordPress runtime. Because WordPress core, the plugin itself, and other active plugins typically expose 'POP gadget' chains, deserialization frequently escalates to arbitrary file writes, SQL execution, or RCE depending on the available class graph.

RemediationAI

Upgrade the 'Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' plugin to a version newer than 1.4.3 once the vendor publishes a fixed release; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-salesforce/vulnerability/wordpress-integration-for-salesforce-and-contact-form-7-wpforms-elementor-formidable-ninja-forms-plugin-1-4-3-php-object-injection-vulnerability for the exact patched version (no vendor-released patched version is independently confirmed in the provided data). If a fixed version is not yet available, deactivate and remove the plugin until a patch ships - the only reliable mitigation for unauthenticated deserialization is to take the vulnerable sink offline, since input validation at the WAF layer can be bypassed by base64- or gzip-wrapped payloads. As compensating controls, deploy a WordPress-aware WAF rule (Patchstack, Wordfence, or equivalent vPatch) that blocks serialized PHP payload markers (e.g. 'O:' object tokens) on the plugin's REST and admin-ajax endpoints, restrict access to /wp-admin/admin-ajax.php and any plugin-specific endpoints via IP allowlists where feasible, and audit recent web/error logs for suspicious payloads; note that WAF rules can break legitimate Salesforce sync traffic and IP restrictions may block legitimate form submissions, so test before enforcing.