What is the CVSS score of CVE-2026-49765?

CVE-2026-49765 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Integration for Mailchimp are affected by CVE-2026-49765?

The Integration for Mailchimp and Contact Form 7 WordPress plugin (CRM Perks, versions ≤1.1.8) contains an unauthenticated remote code execution vulnerability (CVSS 9.8) that enables attackers to…

How to fix or mitigate CVE-2026-49765?

Within 24 hours: audit all WordPress installations for this plugin; immediately disable or remove affected versions. Within 7 days: evaluate alternative CRM integration solutions and implement Web Application Firewall rules blocking PHP object deserialization patterns. Within 30 days: migrate to patched plugin version once released, or deploy permanent alternative CRM integration architecture.

Integration for Mailchimp CVE-2026-49765

EUVD-2026-36889 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-3f48-hjp5-xvrg

PHP Deserialization Integration For Mailchimp And Contact Form 7 Wpforms Elementor Ninja Forms Elementor

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable deserialization sink (AV:N, PR:N, UI:N), but practical RCE depends on finding a usable POP gadget chain, warranting AC:H over the assigned AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:30 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the WordPress plugin 'Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms' (versions <= 1.1.8) allows remote attackers to deserialize attacker-controlled data, potentially leading to remote code execution when a suitable POP (property-oriented programming) gadget chain exists in the WordPress environment. The flaw is reachable without authentication and carries a CVSS 9.8 rating, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. The plugin is distributed by CRM Perks and was disclosed via Patchstack.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) issue in the PHP code of the affected WordPress plugin. PHP Object Injection occurs when user-controlled input is passed to PHP's unserialize() function (or equivalent), which instantiates arbitrary classes and triggers their magic methods (__wakeup, __destruct, __toString). Per the CPE 'cpe:2.3:a:crm_perks:integration_for_mailchimp_and_contact_form_7,_wpforms,_elementor,_ninja_forms', the affected component is a CRM Perks integration plugin that bridges popular WordPress form plugins (Contact Form 7, WPForms, Elementor Forms, Ninja Forms) with Mailchimp. Because WordPress core and bundled plugins ship numerous classes with exploitable magic methods, an attacker who controls a serialized payload can typically chain gadgets to achieve file write, SQL injection, or remote code execution.

RemediationAI

Patch available per vendor advisory: upgrade the plugin to a version newer than 1.1.8 as soon as CRM Perks publishes a fixed release; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-mailchimp/vulnerability/wordpress-integration-for-mailchimp-and-contact-form-7-wpforms-elementor-ninja-forms-plugin-1-1-8-php-object-injection-vulnerability for the confirmed fixed version. If an upgrade is not immediately possible, the most effective compensating control is to deactivate and remove the plugin until patched - this loses Mailchimp integration functionality but eliminates the attack surface. Alternatively, place the WordPress site behind a WAF (such as Patchstack's vPatching or Wordfence) with rules that block serialized PHP payloads (strings containing patterns like 'O:<digits>:' or 'a:<digits>:{') on the endpoints exposed by this plugin, accepting that WAF bypasses are possible and that signature-based rules may produce false positives on legitimate form submissions.