What is the CVSS score of CVE-2026-49763?

CVE-2026-49763 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Integration for Contact Form 7 HubSpot are affected by CVE-2026-49763?

A critical vulnerability in the Contact Form 7 HubSpot WordPress plugin (versions ≤1.3.7) exposes websites to unauthenticated remote code execution, creating immediate risk of complete site…

How to fix or mitigate CVE-2026-49763?

Within 24 hours: Identify all WordPress instances running Contact Form 7 HubSpot plugin version ≤1.3.7 through automated vulnerability scanning or manual plugin audits. Within 7 days: Disable the vulnerable plugin immediately and migrate form functionality to an alternative solution (WPForms, Forminator, or standalone Contact Form 7). Within 30 days: Monitor official Patchstack and plugin repository advisories; when a patched version is released, test thoroughly and upgrade to the fixed version before re-enabling the plugin.

Integration for Contact Form 7 HubSpot CVE-2026-49763

EUVD-2026-36887 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-6f45-2725-f94r

PHP Deserialization Integration For Contact Form 7 Hubspot

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable form submission triggers unserialize() with no user interaction; successful POP chain yields full code execution, hence C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:31 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Integration for Contact Form 7 HubSpot WordPress plugin (versions <= 1.3.7) allows remote attackers to inject malicious serialized PHP objects, which can lead to full site compromise when a suitable POP gadget chain exists in WordPress core or co-installed plugins. The flaw is reachable without authentication or user interaction (CVSS 9.8) and was reported by Patchstack. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data) in the CRM Perks 'Integration for Contact Form 7 HubSpot' plugin (CPE cpe:2.3:a:crm_perks:integration_for_contact_form_7_hubspot). PHP Object Injection occurs when attacker-controlled input reaches a call to unserialize(), instantiating arbitrary PHP classes and triggering 'magic methods' (__wakeup, __destruct, __toString) during object construction or destruction. In the WordPress ecosystem, exploitation typically chains these magic methods through POP (Property-Oriented Programming) gadgets present in WordPress core or other installed plugins, enabling arbitrary file writes, SQL injection, or remote code execution even though the vulnerable sink itself only deserializes data.

RemediationAI

Upstream fix availability is not independently confirmed from the provided input; administrators should upgrade the plugin to the latest version above 1.3.7 as published by CRM Perks and tracked at https://patchstack.com/database/wordpress/plugin/cf7-hubspot/vulnerability/wordpress-integration-for-contact-form-7-hubspot-plugin-1-3-7-php-object-injection-vulnerability. If no patched release is yet available, deactivate and remove the plugin until a fix lands - this is the only reliable mitigation for unauthenticated deserialization. As a temporary compensating control, place a WAF rule (e.g., Patchstack mU plugin, Wordfence) in front of the site to block request payloads containing serialized PHP markers (O:, a:, s:) directed at the plugin's Contact Form 7 submission endpoints; this can produce false positives on legitimate form submissions containing similar character sequences and does not eliminate residual risk if the rule is bypassed.