CVE-2026-49763
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The Integration for Contact Form 7 HubSpot plugin version 1.3.7 and earlier contains an unauthenticated PHP Object Injection vulnerability. An attacker can remotely inject a malicious PHP object, potentially leading to arbitrary code execution or other dangerous operations.
Risk Assessment
The risk for the organization includes the possibility of remote server takeover, data theft, or website disruption. The vulnerability does not require authentication, making it easier to exploit.
Recommendation
It is recommended to immediately update the Integration for Contact Form 7 HubSpot plugin to the latest available version that fixes this vulnerability. Also, check for any signs of security breach.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.