CVE-2026-49106

CriticalCVSS 9.8

Published: 15/06/2026(UTC)Updated: 15/06/2026(UTC)Translated: 16/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile — higher than 30% of all known CVEs

In versions of Integration for Contact Form 7 and Constant Contact up to 1.1.6, there is a vulnerability to unauthenticated PHP object injection.

An attacker could exploit this vulnerability to gain control over the application, potentially leading to data leakage or malicious actions.

It is recommended to update to the latest version of the plugin to mitigate this vulnerability.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.