The vulnerability is a deserialization flaw that allows an attacker to inject PHP objects through untrusted data. By forging serialized input, the attacker can create arbitrary objects that, when deserialized by the plugin, enable execution of malicious PHP code or manipulation of the application state. The weakness is classified as CWE-502, and its impact is the ability to compromise the confidentiality, integrity, and availability of the affected WordPress site.

The affected product is WP Optimize By xTraffic from the vendor pep.vn. All released versions up to and including 5.1.6 are vulnerable. No higher, fixed versions are listed, so all installations with 5.1.6 or older must be addressed.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a web request that contains crafted serialized data processed by the plugin. An attacker would need network reach to the WordPress site and the ability to submit data to the plugin’s endpoints, but does not require authentication.