Unauthenticated PHP Object Injection in Contact Form 7 HubSpot Integration

Publication date: 2026-06-15

Last updated on: 2026-06-15

Assigner: Patchstack

Description

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-15

Last Modified

2026-06-15

Generated

2026-07-06

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-04

NVD

CVE-2026-49763

Affected Vendors & Products

Vendor	Product	Version / Range
hubspot	contact_form_7_integration	to 1.3.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated PHP Object Injection in the Integration for Contact Form 7 HubSpot plugin, affecting versions up to and including 1.3.7.

Impact Analysis

The vulnerability has a high severity with a CVSS score of 9.8, indicating it can be exploited remotely without authentication, leading to complete compromise of confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-49763. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70