This vulnerability (CVE-2026-49109) is classified as CWE-502: Deserialization of Untrusted Data. It affects crm perks Integration for Salesforce and several WordPress form plugins up to version 1.4.3. The flaw allows unauthenticated attackers to inject malicious PHP objects, leading to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The product is cloud-hosted, and the vendor manages remediation for this service. Although no known exploits are reported in the wild, the critical nature demands attention.

Successful exploitation can lead to complete compromise of the affected system's confidentiality, integrity, and availability. Attackers can execute arbitrary code remotely without authentication, potentially leading to data breaches, service disruption, or full system takeover.

The vendor manages remediation for this cloud-hosted service and has made a patch available. Users should verify with the vendor advisory to ensure their instance is updated or patched accordingly. Since the vendor controls the cloud environment, no additional user action may be required beyond confirming the update status.