Executive brief
A vulnerability exists in a popular WordPress plugin used to connect website contact forms with HubSpot CRM. This flaw allows an unauthenticated attacker to remotely execute malicious code or gain unauthorized access to the website's database and files. If exploited, this could lead to a total takeover of the website, theft of customer data, or a complete service outage.
Technical details
The Integration for Contact Form 7 HubSpot plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 1.3.7. This issue stems from the deserialization of untrusted data (CWE-502) without proper validation. An unauthenticated remote attacker can exploit this by submitting specially crafted input to a vulnerable endpoint. If a suitable Property-Oriented Programming (POP) chain is present in the environment, the attacker can achieve remote code execution, SQL injection, or arbitrary file access. The vulnerability is resolved in version 1.3.8.
Affected products
- Hitesh Makwana Integration for Contact Form 7 HubSpot <= 1.3.7
Timeline
- 2025-05-17: other: Reported by researcher Frissi0n
- 2026-06-04: patched: Version 1.3.8 released
- 2026-06-15: disclosed: CVE published to NVD