Deserialization of untrusted data occurs in the Metagauss ProfileGrid WordPress plugin, enabling an attacker to inject a malicious object. This allows the attacker to execute arbitrary code on the affected server, compromising confidentiality, integrity, and availability of the website and potentially exfiltrating data. The weakness is a classic PHP deserialization flaw, classified as CWE‑502.

The vulnerability affects WordPress users running the Metagauss ProfileGrid plugin version 5.9.4.3 or earlier. No specific WordPress core or other plugin versions are affected; only the ProfileGrid plugin in the identified range is impacted.

The CVSS base score of 8.8 signals a high severity and indicates that the flaw could be exploited remotely. The EPSS score of <1% suggests exploitation likelihood is low, though it remains a potential target for advanced attackers. The vulnerability is not listed in CISA KEV, indicating no confirmed public exploitation yet. Attackers would likely need to interact with the plugin through normal site operations, such as form submissions or user profile updates, to exploit the object injection path.