Description
Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CRM Perks | Integration for Contact Form 7 HubSpot | ≤ 1.3.7 | — |
Critical · 9.8
CVE-2026-49763
EUVD-2026-36887GHSA-6f45-2725-f94r
WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability
Published Jun 15, 2026 · Updated Jul 8, 2026 · Assigned by Patchstack