← All advisories

Critical severity9.8NVD Advisory· Published Jun 15, 2026· Updated Jun 15, 2026

CVE-2026-49763

CVE-2026-49763

Description

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

WordPress/Cf7 Hubspotinferred
Range: <=1.3.7
Package: https://wordpress.org/plugins/cf7-hubspot
WordPress/Integration for Contact Form 7 HubSpotllm-create
Range: <=1.3.7

Patches

Vulnerability mechanics

References

1

patchstack.com/database/wordpress/plugin/cf7-hubspot/vulnerability/wordpress-integration-for-contact-form-7-hubspot-plugin-1-3-7-php-object-injection-vulnerabilitynvd

News mentions

2

25 WordPress Plugin CVEs Disclosed in One Day: 11 Critical Flaws Lead the Batch
Vypr Intelligence · Jun 15, 2026
Wordfence Intelligence Weekly WordPress Vulnerability Report (June 1, 2026 to June 7, 2026)
Wordfence Blog · Jun 11, 2026