Deserialization of untrusted data in the Integration for Contact Form 7 and Zoho CRM, Bigin plugin leads to PHP object injection, a severe vulnerability that can allow attackers to execute arbitrary PHP code on the server, compromising confidentiality, integrity, and availability. The flaw directly stems from the use of unserialize() on user‑controlled input, aligning with CWE‑502. The plugin processes data from the WordPress contact form, so any inbound form submission could trigger the injection if not properly protected.

The vulnerability affects the CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin in WordPress for versions 1.3.0 and earlier. All installations of the plugin before the release of the patched version are exposed, regardless of the WordPress core or PHP version, as the flaw lies within the plugin’s code base.

With a CVSS score of 9.8 the severity is critical. The EPSS score of less than 1% indicates a low current exploitation probability, yet the vulnerability remains unlisted in CISA’s KEV catalog. The likely attack vector is through web traffic to the plugin’s endpoint, where an attacker can craft a serialized object payload via the contact form. Successful exploitation can lead to uncontrolled code execution.