This vulnerability (CVE-2026-49765) is a deserialization of untrusted data issue (CWE-502) in the CRM Perks Integration plugin for Mailchimp and Contact Form 7, WPForms, Elementor, and Ninja Forms, specifically in versions up to 1.1.8. It allows unauthenticated attackers to inject PHP objects remotely, which can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the affected system, including remote code execution, data disclosure, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a high level as indicated by the CVSS score of 9.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the vulnerable plugin to untrusted networks. Follow vendor channels for updates and apply official fixes once released.