The vulnerability is a PHP Object Injection flaw caused by insecure deserialization of untrusted data in the Pdfcrowd Dev Team "Save as PDF" plugin up to version 4.4.0. Exploitation of this fault allows an attacker to inject malicious objects that can execute arbitrary code on the hosting server, thereby compromising both confidentiality and integrity of site data.

Vulnerable products are the Pdfcrowd Dev Team "Save as PDF" WordPress plugin listed through version 4.4.0. Any WordPress installation using this plugin without a newer release is affected.

The CVSS score of 9.8 marks the issue as critical, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not catalogued in CISA’s KEV. Attackers can exploit the flaw remotely by sending crafted requests to the plugin’s processing endpoint, although the precise authentication or privilege prerequisites are not detailed in the advisory. Given the severity, the risk remains high if the plugin is active on a publicly accessible server.