This vulnerability (CVE-2026-9691) is classified as CWE-502, indicating deserialization of untrusted data. It affects the Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin by CRM Perks in versions <= 1.1.1. The flaw allows unauthenticated attackers to inject PHP objects remotely, which can lead to remote code execution or other severe impacts. The CVSS v3.1 base score is 9.8, reflecting its critical nature with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary PHP code on the affected system, leading to full compromise of the web server hosting the plugin. This includes potential data theft, data manipulation, and denial of service. The critical CVSS score (9.8) confirms the high severity and potential for significant impact on affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected plugin functionality where possible, monitor for unusual activity, and consider disabling the plugin if feasible. Avoid exposing the affected plugin to untrusted networks. Follow updates from the CRM Perks vendor for an official patch or mitigation instructions.