Description
Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.
Published: 2025-09-09
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Deserialization of untrusted data in the Constant Contact for WordPress plugin allows attackers to perform object injection, which could enable execution of arbitrary PHP code, compromising the confidentiality, integrity, or availability of the host system. This vulnerability has a CVSS score of 8.8, indicating high severity.

Affected Systems

The weakness affects the Constant Contact for WordPress plugin by webdevstudios, versions up to and including 4.1.1. No patched version exists; the plugin has been permanently closed and is no longer available for download.

Risk and Exploitability

The EPSS score is less than 1%, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers could potentially trigger the deserialization path through normal plugin functionality or specially crafted web requests; the exact entry point is not specified, but it is inferred that the plugin processes user-supplied data without adequate validation.

Generated by OpenCVE AI on April 30, 2026 at 06:58 UTC.

Remediation

Vendor Solution

No patched version is available. This plugin has been closed as of August 26, 2025 and is not available for download. This closure is permanent. Reason: Author Request.

OpenCVE Recommended Actions

  • Uninstall the Constant Contact for WordPress plugin from the site.
  • Remove any residual files or database entries associated with the plugin.
  • Replace the plugin with a vetted alternative that properly validates deserialized data, or disable contact form functionality until a secure solution is available.

Generated by OpenCVE AI on April 30, 2026 at 06:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-27457 Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.
History

Tue, 28 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
References

Tue, 28 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress constant-contact-api allows Object Injection.This issue affects Constant Contact for WordPress: from n/a through <= 4.1.1. Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.
References

Thu, 23 Apr 2026 15:45:00 +0000

Type Values Removed Values Added
References

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1. Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress constant-contact-api allows Object Injection.This issue affects Constant Contact for WordPress: from n/a through <= 4.1.1.
References

Tue, 09 Sep 2025 23:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Sep 2025 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Webdevstudios
Webdevstudios constant Contact For Wordpress
Wordpress
Wordpress wordpress
Vendors & Products Webdevstudios
Webdevstudios constant Contact For Wordpress
Wordpress
Wordpress wordpress

Tue, 09 Sep 2025 16:45:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.
Title WordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection Vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Webdevstudios Constant Contact For Wordpress
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:51.212Z

Reserved: 2025-05-15T17:54:35.012Z

Link: CVE-2025-48101

cve-icon Vulnrichment

Updated: 2025-09-09T17:48:43.920Z

cve-icon NVD

Status : Deferred

Published: 2025-09-09T17:15:47.463

Modified: 2026-04-28T19:32:35.500

Link: CVE-2025-48101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T07:00:13Z

Weaknesses