The vulnerability is a PHP Object Injection that arises from deserializing untrusted data, classified as CWE-502. This flaw can allow a malicious actor to execute arbitrary PHP code, potentially compromising the entire site. The primary impact is remote code execution, allowing the attacker to read, modify, or delete site data and compromise confidentiality, integrity, and availability.

The affected product is the GNUCommerce plugin for WordPress, developed by kagla, from unknown initial versions through version 1.5.4. All installations running these versions are vulnerable.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1% signals a low-but-non-zero likelihood of exploitation. Based on the description, it is inferred that the flaw could be triggered by submitting a crafted object payload via any plugin endpoint that deserializes user input. While the vulnerability is not currently listed in the CISA KEV catalog, the high severity and potential for remote code execution warrant prompt action.