Skip to main content

Integration for Salesforce CVE-2026-49109

| EUVD-2026-36884 CRITICAL
Deserialization of Untrusted Data (CWE-502)
2026-06-15 Patchstack GHSA-3vcv-283p-87rc
PHP Deserialization Integration For Salesforce And Contact Form 7 Wpforms Elementor Formidable Ninja Forms Elementor
9.8
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
9.8 CRITICAL

Unauthenticated network-reachable WordPress plugin endpoint passes attacker input to unserialize(), enabling full CIA compromise via POP chain RCE with no user interaction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 15, 2026 - 21:33 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

AnalysisAI

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' (versions <= 1.4.3) allows remote attackers to pass attacker-controlled serialized data into PHP's unserialize() function. With a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and no authentication required, successful exploitation can lead to arbitrary code execution, data theft, or full site takeover when a suitable POP gadget chain is present. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Identify WordPress site running vulnerable plugin
Delivery
Send unauthenticated HTTP request with serialized payload
Exploit
Plugin passes input to unserialize()
Install
Magic methods invoke POP gadget chain
C2
Write PHP webshell to wp-content
Execute
Execute arbitrary code as web user
Impact
Pivot to full site takeover
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerable plugin 'Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' (<= 1.4.3) must be installed and activated on a WordPress site that is reachable over the network, with the affected endpoint (a form-handling or Salesforce-integration entry point) exposed to unauthenticated visitors as is typical for any public-facing form. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) signals an unauthenticated, network-reachable, low-complexity flaw with full CIA impact - the worst category for an internet-facing WordPress plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends an HTTP POST request to a public endpoint exposed by the vulnerable plugin (such as a form-submission handler or admin-ajax action) with a parameter containing a crafted PHP serialized object. The WordPress instance unserializes the payload, instantiating attacker-chosen classes whose __wakeup() or __destruct() magic methods execute a POP gadget chain drawn from WordPress core or other installed plugins. …
Remediation Upgrade the 'Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' plugin to a version newer than 1.4.3 once the vendor publishes a fixed release; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-salesforce/vulnerability/wordpress-integration-for-salesforce-and-contact-form-7-wpforms-elementor-formidable-ninja-forms-plugin-1-4-3-php-object-injection-vulnerability for the exact patched version (no vendor-released patched version is independently confirmed in the provided data). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Disable the plugin immediately via WordPress admin; audit server and WordPress logs for exploitation attempts (search for serialized object patterns in HTTP requests and PHP error logs). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-55692 HIGH POC
7.5 Jun 19

Stored cross-site scripting in the StarCitizenWiki EmbedVideo MediaWiki extension (versions <= 4.0.0) allows any user wi
CVE-2026-9815 MEDIUM POC
6.5 Jun 18

Unrestricted PHP file upload in the MagicForm WordPress plugin (through version 0.1.3) enables unauthenticated remote co
CVE-2026-48908 CRITICAL
10.0 Jun 20

Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through

CVE-2026-48939 CRITICAL
10.0 Jun 20

Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the eve
CVE-2025-69108 CRITICAL
9.8 Jun 16

Unauthenticated PHP Object Injection in the ThemeREX Hot Coffee WordPress theme (versions ≤ 1.7) allows remote attackers

Share

CVE-2026-49109 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy