The vulnerability is a deserialization of untrusted data in the Flexmls® IDX WordPress plugin, which permits arbitrary PHP object injection. This flaw can allow an attacker to execute arbitrary code, modify data, or otherwise compromise the integrity of the WordPress site through the injected objects. The weakness is identified as CWE‑502, deserialization of untrusted input.

Any WordPress installation that has the Flexmls® IDX plugin for versions up to 3.14.27, including all earlier releases for which no version information is listed, is affected. The plugin is distributed under the vendor name flexmls:Flexmls® IDX.

The CVSS score of 9.8 classifies this vulnerability as Critical. The EPSS score of less than 1% indicates that, while exploitation is currently rare, the potential for a remote exploitation path exists. The attack vector is inferred to be remote, where a malicious user can supply a crafted serialized payload through the plugin’s processing endpoints. The vulnerability is not listed in the CISA KEV catalog at this time, but is publicly disclosed and could be exploited by attackers with sufficient motivation.