This vulnerability arises from unsafe deserialization of untrusted data in the CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin. Versions up to and including 1.3.0 are affected. The issue permits object injection, which can be exploited remotely without authentication. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution, complete system compromise, data theft, data manipulation, and service disruption. The vulnerability affects all installations of the plugin up to version 1.3.0. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider disabling or removing the affected plugin to mitigate risk.