The TranslatePress plugin for WordPress contains a deserialization flaw that allows attackers to inject malicious PHP objects. This PHP Object Injection vulnerability is a classic instance of CWE-502 (Deserialization of Untrusted Data). An attacker who can influence the plugin’s input payload can cause the plugin to create arbitrary objects, potentially leading to execution of arbitrary code or other malicious actions on the affected WordPress site.

The flaw is present in all versions of the TranslatePress plugin up to and including 2.9.6, distributed by Cozmoslabs. Any WordPress site that has the plugin installed at a vulnerable version is at risk.

With a CVSS score of 7.2, the vulnerability is considered high severity. Its EPSS score of less than 1% indicates a low likelihood of wide exploitation at present, and it is not listed in CISA’s KEV catalog. The most likely attack vector is remote, requiring an attacker to send a crafted request that includes the malicious serialized payload to the plugin’s endpoint. If successful, the attacker could achieve remote code execution within the context of the WordPress installation.