The ChamaWP WordPress plugin before version 1.0.13 fails to validate user input that is passed to a PHP deserialization function. This flaw permits unauthenticated attackers to inject arbitrary PHP objects into the application. In the presence of a suitable gadget chain within the system or other installed code, the attacker can execute arbitrary code on the server, compromising confidentiality, integrity, and availability.

The vulnerability affects the ChamaWP WordPress plugin versions earlier than 1.0.13. Users running an impacted version of this plugin on any WordPress installation are at risk.

Because PHP object injection directly leads to possible remote code execution, the risk level is high. The CVSS score of 8.1 indicates high severity, and the EPSS score is <1%, but the absence of a KEV listing does not reduce the potential impact. The likely attack vector is any web request that the plugin processes without proper input sanitization, allowing an attacker to supply crafted data that will be deserialized. The exploit requires the existence of a gadget chain, but once such a chain is present, execution can be achieved with no user authentication.