This vulnerability (CVE-2026-49105) is classified as CWE-502 (Deserialization of Untrusted Data) affecting WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms plugins up to version 1.1.4. It allows unauthenticated attackers to inject malicious PHP objects remotely, leading to potential remote code execution or other severe impacts. The vulnerability is publicly known but no patch or official remediation has been documented at this time. The CVSS 3.1 base score is 9.8, reflecting critical impact with full confidentiality, integrity, and availability compromise possible without any privileges or user interaction.

Successful exploitation of this vulnerability can lead to remote code execution or other severe impacts compromising the confidentiality, integrity, and availability of the affected system. Since the vulnerability is exploitable without authentication and user interaction, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the affected plugin to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.