PT-2026-49509 · Crm Perks+1 · Integration For Contact Form 7/Salesforce+1
CVE-2026-49109
·
Published
2026-06-04
·
Updated
2026-06-15
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms versions prior to 1.4.4
Description
An unauthenticated attacker can perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, allowing an attacker to manipulate the resulting object. While no POP chain is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.
Recommendations
Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to version 1.4.4 or later.
Fix
DoS
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Integration For Contact Form 7/Salesforce
Cf7-Salesforce