The flaw is a deserialization of untrusted data leading to PHP object injection, which allows an attacker to instantiate arbitrary PHP objects and execute malicious code, potentially compromising the entire web application. The injection can hijack the plugin’s execution flow, giving the attacker full control over server processes and data. The weakness is classified as CWE-502, a serialization flaw that permits remote code execution when untrusted data is processed.

The vulnerability affects the Rapyd Payment Extension for WooCommerce plugin by yuliaz, versions up to and including 1.2.0. Any WordPress site that has installed this plugin with a version number less than or equal to 1.2.0 is potentially impacted.

The CVSS score of 9.8 marks this as a critical risk, but the EPSS score of less than 1% indicates a currently low probability of exploitation. The plugin does not appear in the CISA KEV catalog. Based on the description, the attack vector is likely remote via crafted HTTP requests that deliver malicious serialized objects to the plugin. Successful exploitation could result in full server compromise or data exfiltration.