The PGS Core plugin for WordPress contains an unsafe deserialization flaw in the import_header function that allows a PHP Object Injection vulnerability (CWE-502). An attacker can craft a serialized payload that is processed by the plugin, leading to the instantiation of arbitrary PHP objects. While the plugin itself does not provide a ready-to-use PHP Object Poisoning (POP) chain, the injection can still be leveraged if a malicious object triggers code that is subsequently executed by other components of the WordPress installation, enabling arbitrary file manipulation or code execution.

All installations of Potenza Global Solutions’ PGS Core WordPress plugin up to and including version 5.8.0 are affected. No other product versions are listed as vulnerable.

The vulnerability scores a CVSS of 9.8 and an EPSS of 3%, indicating a high likelihood of exploitation but a relatively low overall probability of attack at the moment. It is not listed in the CISA KEV catalog. Attackers can trigger the flaw from any unauthenticated web request that reaches the import_header endpoint. Without a ready POP chain the impact is limited to the plugin; however, if the target environment contains additional vulnerable plugins or themes that support PHP object deserialization, an attacker could delete files, exfiltrate data, or execute arbitrary code.