The vulnerability is a PHP Object Injection caused by deserialization of untrusted data. An attacker can inject a crafted serialized object which, when deserialized by the Dash plugin, results in the execution of arbitrary PHP code. This flaw gives the attacker complete control over the vulnerable WordPress site, leading to total loss of confidentiality, integrity, and availability of the affected systems. The weakness aligns with CWE‑502.

The product affected is the WordPress dashboard plugin Dash from themeton. All released versions from the earliest available build through version 1.3 are vulnerable. No other products or versions are noted in the CNA data.

The base CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% implies a low but realistic exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog, so there are no known active public exploits documented yet. Based on the description, the likely attack vector is through the plugin’s data handling paths, where an attacker can supply malicious serialized payloads that are deserialized without proper validation, enabling remote code execution often without authentication.