This vulnerability (CVE-2026-49109) is classified as CWE-502: Deserialization of Untrusted Data. It occurs in the crm perks Integration plugin for Salesforce and several WordPress form plugins (Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms) in versions up to 1.4.3. The flaw allows unauthenticated PHP Object Injection, enabling remote attackers to execute arbitrary code. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The product is cloud-hosted, and the vendor is responsible for patching and mitigating the issue on their side.

Successful exploitation can lead to remote code execution without authentication, compromising confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe, potentially allowing full system compromise.

Since this is a cloud-hosted service, the vendor manages remediation and patches server-side. Users should verify with the vendor advisory that the service has been updated to address this vulnerability. No direct user action is required if the vendor confirms mitigation. Patch status is managed by the vendor for this cloud service; check the vendor advisory for current remediation guidance.