This vulnerability, identified as CWE-502 (Deserialization of Untrusted Data), exists in the Integration for Contact Form 7 HubSpot plugin versions <= 1.3.7. It allows unauthenticated attackers to inject PHP objects remotely, which can lead to arbitrary code execution or other severe impacts. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published as of the provided data.

Successful exploitation of this vulnerability can result in complete compromise of the affected system, including unauthorized data disclosure, modification, and disruption of service. Because the vulnerability is exploitable without authentication and requires no user interaction, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin where possible and monitor for suspicious activity related to deserialization attacks. Avoid exposing the affected plugin to untrusted networks or users.