CVE-2026-49104 CRM Perks CVE debrief

Who should care

Defenders responsible for WordPress installations using the Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin should assess their exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-49104 is a critical vulnerability in the Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin that allows for unauthenticated PHP object injection. Defenders responsible for WordPress installations using this plugin should assess their exposure and prioritize patching or mitigating this vulnerability to prevent potential exploitation.

• Potential for unauthenticated PHP object injection, which can lead to severe consequences such as code execution, data theft, or system compromise.
• Requires verification of affected versions and remediation from official sources.
• Defenders should prioritize patching or mitigating this vulnerability to prevent potential exploitation.

Technical summary

The Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin is vulnerable to unauthenticated PHP object injection. This vulnerability has been assigned a CVSS score of 9.8, indicating a critical severity level.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability as it allows for unauthenticated PHP object injection, which can lead to severe consequences.

Recommended defensive actions

• Patch or upgrade to a fixed version of the Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin.
• Implement additional security measures such as web application firewalls (WAFs) to detect and prevent exploitation attempts.
• Monitor for suspicious activity and implement logging and auditing to detect potential exploitation.

Evidence notes

The vulnerability was reported by [email protected] and is described as a PHP object injection vulnerability in the Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.