The vulnerability is a deserialization of untrusted data that allows an attacker to inject malicious PHP objects. When the plugin processes such data, it can execute arbitrary code, giving the attacker full control over the WordPress site. The weakness is identified as CWE‑502, which signifies a failure to properly validate or sanitize data before deserialization.

The affected product is the WordPress Mobile DJ Manager plugin developed by MDJM. Versions from the earliest release through and including 1.7.5.2 are impacted. Any site running those versions on WordPress is at risk.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score of less than 1% indicates that exploitation probability is currently low, and there is no record of exploitation in the CISA KEV catalog. Nevertheless, the potential to achieve remote code execution makes this a critical concern for sites that still use the vulnerable plugin versions. An attacker would need to supply a crafted serialized payload to the plugin’s processing routines, which, while not trivial, is feasible for a motivated adversary.