This vulnerability (CVE-2026-49106) is a PHP object injection issue classified under CWE-502, affecting the Integration for Contact Form 7 and Constant Contact plugin by CRM Perks. It allows unauthenticated attackers to inject malicious serialized PHP objects, leading to remote code execution. The affected versions include all versions up to and including 1.1.6. The vulnerability is publicly known and has a CVSS 3.1 base score of 9.8, reflecting its critical severity. No official patch or remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized code execution, complete loss of confidentiality, integrity, and availability of the application and potentially the underlying server. Since the vulnerability is exploitable without authentication, it poses a significant risk to all installations running affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable plugin and monitor for suspicious activity. Avoid exposing the vulnerable plugin to untrusted networks. Follow updates from CRM Perks for any forthcoming patches or official mitigations.