The FundPress plugin deserializes data supplied by an attacker without proper validation, allowing an object injection attack. Attackers can craft a malicious payload that, when processed by the plugin's unserialize logic, can execute arbitrary PHP code, leading to full compromise of the WordPress site. The vulnerability is identified as CWE-502, indicating improper handling of untrusted serialized objects, and the high CVSS score of 9.8 reflects the severity and potential impact on confidentiality, integrity, and availability.

The vulnerability affects the ThimPress FundPress WordPress plugin, version 2.0.6 and earlier. Any WordPress installation running these versions of the plugin is susceptible.

With a CVSS score of 9.8 the risk is critical. The EPSS score is less than 1%, indicating a low measured probability of exploitation at this time, and the vulnerability is not listed in CISA's KEV catalog. However, because the flaw permits remote code execution, any attacker who can influence unsanitized input to the plugin can potentially compromise the entire site. The attack vector is likely through any endpoint or admin action that accepts serialized data from users or external sources, leading to an unserialize operation with no restriction on object context.