What is the CVSS score of CVE-2026-9691?

CVE-2026-9691 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Integration for ActiveCampaign are affected by CVE-2026-9691?

The CRM Perks integration plugin for WordPress (versions 1.1.1 and earlier) contains a critical unauthenticated remote code execution vulnerability (CVSS 9.8) that allows attackers to execute…

How to fix or mitigate CVE-2026-9691?

24 hours: Identify all WordPress instances using 'Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms' plugin version 1.1.1 or earlier; immediately disable the plugin if not business-critical. 7 days: For critical business functions, implement temporary compensating controls (WAF rules, IP whitelisting); contact vendor to confirm patch timeline and evaluate alternative plugins. 30 days: Deploy vendor patch (version to be determined upon release) to all WordPress staging and production environments after security testing.

Integration for ActiveCampaign CVE-2026-9691

EUVD-2026-36908 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-gpvc-87r4-hfmw

PHP Deserialization Integration For Activecampaign And Contact Form 7 Wpforms Elementor Ninja Forms Elementor

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable WordPress endpoint deserializes attacker input, enabling RCE via POP chains with full CIA impact, matching AV:N/AC:L/PR:N/UI:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:21 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the WordPress plugin 'Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms' (versions 1.1.1 and earlier) allows remote attackers to inject crafted serialized objects that are deserialized by the plugin, enabling abuse of POP gadget chains for code execution, file operations, or data tampering. The flaw scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and impacts any WordPress site running the affected CRM Perks integration plugin. There is no public exploit identified at time of analysis, but the unauthenticated nature and prevalence of WordPress as a target make this a high-priority patching item.

Technical ContextAI

The vulnerability is a CWE-502 Deserialization of Untrusted Data flaw in a PHP-based WordPress plugin maintained by CRM Perks that bridges ActiveCampaign with popular form builders (Contact Form 7, WPForms, Elementor Forms, Ninja Forms). The affected component (cpe:2.3:a:crm_perks:integration_for_activecampaign_and_contact_form_7,_wpforms,_elementor,_ninja_forms) passes attacker-controlled input into PHP's unserialize() (or equivalent) without validation, instantiating arbitrary classes. When combined with POP (Property-Oriented Programming) gadget chains present in WordPress core, other plugins, or the bundled form-builder integrations, this can be escalated to arbitrary file write, SQL execution, or remote code execution depending on the loaded class graph at the time of the request.

RemediationAI

Patch available per vendor advisory; upgrade the plugin to a version greater than 1.1.1 as listed by CRM Perks through the WordPress.org plugin repository, with the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-active-campaign/vulnerability/wordpress-integration-for-activecampaign-and-contact-form-7-wpforms-elementor-ninja-forms-plugin-1-1-1-php-object-injection-vulnerability serving as the reference (an exact fixed version is not independently confirmed in the supplied data). If immediate upgrade is not possible, deactivate the plugin entirely until patched, since the integration is a non-critical CRM connector and disabling it primarily breaks lead-syncing rather than site availability; alternatively, place a WAF rule (Patchstack, Wordfence, or equivalent) in front of the affected plugin endpoints to block requests containing serialized PHP payloads (e.g., parameters matching ^O:\d+:" or a:\d+:\{), accepting that overly broad signatures can produce false positives on legitimate form submissions and should be tuned against your form fields.