CVE-2026-49106

Name of the Vulnerable Software and Affected Versions Integration for Contact Form 7 and Constant Contact versions prior to 1.1.7

Description An unauthenticated attacker can perform PHP Object Injection through the deserialization of untrusted input. This occurs when the application processes data that has been serialized into a PHP object without proper validation. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain in another installed plugin or theme could allow the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 1.1.6.