The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in the URL Shortener plugin. Attackers can craft malicious payloads that, when deserialized, result in execution of arbitrary code on the affected WordPress site. This type of flaw can lead to complete compromise of the server, including data disclosure, modification, and availability impact.

The flaw affects the Md Yeasin Ul Haider 'URL Shortener' WordPress plugin in all releases up to and including version 3.0.7. Installing or using any of these versions exposes the site to potential exploitation.

The CVSS score of 9.8 reflects the high severity and full remote exploitation potential. The EPSS score of less than 1% indicates that, as of this analysis, the probability of observed exploitation remains very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request to the plugin’s deserialization endpoint; based on the description, it is inferred that an attacker could trigger the flaw by sending a specially crafted serialized object, but direct evidence of the exact endpoint is not provided.