This vulnerability (CVE-2026-9691) is classified as CWE-502: Deserialization of Untrusted Data. It affects the Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin by CRM Perks in versions up to 1.1.1. The flaw allows unauthenticated attackers to inject malicious PHP objects via deserialization, which can result in remote code execution or other severe impacts. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published yet, and no known exploits in the wild have been reported.

Successful exploitation can lead to complete compromise of the affected system, including unauthorized code execution, data disclosure, and service disruption. Because the vulnerability is exploitable without authentication and requires no user interaction, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable plugin functionality where possible and monitor for suspicious activity related to deserialization attacks. Avoid exposing the affected plugin to untrusted network sources.