The Doubly plugin for WordPress contains a PHP Object Injection flaw that activates when a user with at least Subscriber permissions uploads a ZIP archive containing a malicious content.txt file. The plugin blindly deserializes this file, allowing an attacker who has both authentication and the import capability to inject a crafted PHP object. If a PHP object‑payload chain is present, the attacker can achieve remote code execution, delete files, exfiltrate data, or otherwise manipulate the site. This weakness is identified as CWE‑502 and enables the attacker to compromise the confidentiality, integrity or availability of the WordPress installation, but only while the vulnerable import functionality is enabled for non‑administrator roles.

All installations of the Doubly – Cross Domain Copy Paste for WordPress plugin up to and including version 1.0.46 are affected. The status of later versions (e.g., 1.0.47) is not explicitly stated in the provided data.

The vulnerability carries a CVSS score of 8.8, indicating high overall severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalogue. Exploitation requires authentication with a Subscriber‑level role and the ability to upload ZIP files, which some site administrators enable. Attackers can use the deserialized object to launch arbitrary code, delete or steal files, or manipulate content, all of which are feasible only on sites that have retained the vulnerable plugin and granted import rights to subscribers.