The vulnerability lies in the Visitor Logic Lite plugin for WordPress, which deserializes data from the lpblocks cookie without validation. This PHP Object Injection flaw, identified as CWE‑502, allows an unauthenticated attacker to inject any PHP object into the application. While no exploitation chain is built into the plugin itself, the injected object could be used in conjunction with a vulnerable class from another plugin or theme to delete files, read sensitive data or execute arbitrary code, assuming the attacker can reach the site’s HTTP interface.

All releases of Visitor Logic Lite up to and including version 1.0.3 from the vendor rodgerholl are affected. No specific version ranges beyond the stated limit are listed, and the issue applies to every installation of the plugin prior to 1.0.4.

The CVSS score of 8.1 indicates a high severity, yet the EPSS score is below 1%, suggesting a low probability of exploitation at any given time. The vulnerability is not present in the CISA KEV catalog, which reduces perceived urgency. The likely attack vector is through manipulation of the lpblocks cookie by any user who can visit a URL under the site domain. In isolation, the flaw cannot be exploited; however, if the target environment hosts any additional plugin or theme that contains a vulnerable class that can be instantiated by the attacker, the consequences can range from file deletion and data exfiltration to full code execution.