This vulnerability (CVE-2026-49104) is classified as CWE-502, indicating deserialization of untrusted data. It affects the Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin by CRM Perks, specifically versions up to 1.2.1. The flaw allows unauthenticated PHP object injection, enabling attackers to execute arbitrary code remotely. The CVSS v3.1 base score is 9.8, reflecting its critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability can lead to remote code execution, complete system compromise, and full control over the affected web server environment. Because the attack requires no authentication and no user interaction, it poses a severe risk to affected installations. The high CVSS score (9.8) confirms the critical nature of this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable plugin functionality, disable or remove the plugin if feasible, and monitor for suspicious activity. Avoid exposing the affected plugin to untrusted networks. Follow vendor channels closely for updates and apply patches immediately once available.