Description
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.
Published: 2026-06-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is unauthenticated PHP Object Injection (CWE-502) in the Integration for Salesforce and Contact Form 7 plugin version 1.4.3 or earlier. Lack of proper authentication and input sanitization allows an attacker to supply malicious serialized data that the plugin processes unchecked, potentially leading to arbitrary code execution and full compromise of the affected WordPress site.

Affected Systems

WordPress sites running the CRM Perks Integration for Salesforce and Contact Form 7 plugin version 1.4.3 or earlier are vulnerable. The plugin supports Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms. No specific operating system or PHP version is stated, but any WordPress environment with these plugin versions is at risk.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests a low exploitation probability at present. The vulnerability is not listed in CISA KEV. The likely attack vector is through sending a crafted HTTP request containing serialized PHP objects to the plugin’s endpoint, bypassing authentication and triggering unserialize, which can lead to remote code execution. A patch is available in version 1.4.4, which removes this flaw.

Generated by OpenCVE AI on June 16, 2026 at 23:07 UTC.

Remediation

Vendor Solution

Update the WordPress Integration for Contact Form 7 and Salesforce plugin to the latest available version (at least 1.4.4).

OpenCVE Recommended Actions

  • Update the Integration for Salesforce and Contact Form 7 plugin to version 1.4.4 or later, which fixes the unserialize flaw.
  • If an immediate update cannot be performed, disable or restrict all endpoints that accept serialized input, or use a web‑application firewall to block requests containing PHP serialized strings.
  • Scan the WordPress installation for other plugins that perform unserialize without validation, upgrade them or remove them if they cannot be secured.
  • After applying fixes, monitor server logs for abnormal PHP execution or unexpected HTTP requests and confirm that no unsanitized unserialize calls are occurring.

Generated by OpenCVE AI on June 16, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 16 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 15 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.
Title WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-16T14:35:53.406Z

Reserved: 2026-05-27T15:12:19.105Z

Link: CVE-2026-49109

cve-icon Vulnrichment

Updated: 2026-06-16T14:35:49.527Z

cve-icon NVD

Status : Deferred

Published: 2026-06-15T21:17:20.750

Modified: 2026-06-15T21:24:32.790

Link: CVE-2026-49109

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-16T23:15:16Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data