The vulnerability arises from the deserialization of untrusted data within the WP Gravity Forms HubSpot plugin, allowing attackers to perform object injection. This flaw can be leveraged to execute arbitrary PHP code on the web server, compromising confidentiality, integrity, and availability of the affected system. The high CVSS score of 9.8 reflects the potential for full system compromise if exploited.

The flaw affects the CRM Perks WP Gravity Forms HubSpot plugin for WordPress, specifically all installations of versions 1.2.6 and earlier. Users running any of these versions are at risk until the plugin is updated or otherwise mitigated.

The security score of 9.8 signals critical severity, but the EPSS rating of <1% indicates that exploitation activity is expected to be rare at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver malicious serialized payloads to the plugin’s deserialization routine, typically via user‑submittable fields or crafted requests. Given the nature of PHP unserialize functions, successful exploitation could grant remote code execution with the privileges of the web server process.