This vulnerability (CVE-2026-49763) is a PHP Object Injection issue classified under CWE-502, affecting the Integration for Contact Form 7 HubSpot plugin by CRM Perks. It allows unauthenticated attackers to exploit unsafe deserialization of untrusted data, leading to remote code execution. The affected versions are up to and including 1.3.7, although explicit affected versions were not provided in the source data. The vulnerability has a critical CVSS 3.1 score of 9.8, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation information is currently available from the vendor or advisory.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized remote code execution, full confidentiality breach, integrity violation, and denial of service. Since no authentication is required, the attack surface is broad and can be exploited remotely by any attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the Integration for Contact Form 7 HubSpot plugin if feasible. Monitor vendor communications for updates and apply patches as soon as they become available.