Deserialization of untrusted data in the WordPress Spare plugin enables PHP object injection, which can lead to remote code execution. The flaw is a classic Deserialization of Untrusted Data issue classified as CWE‑502. An attacker who can influence the input data that the plugin deserializes can inject arbitrary PHP objects, potentially executing arbitrary PHP code or modifying application data, leading to full compromise of the WordPress site.

The plugin Spare by themeton, used on WordPress sites, is affected in all releases up to and including version 1.7. Any WordPress installation running Spare 1.7 or earlier is vulnerable, regardless of the WordPress core version. No specific sub‑versions are listed, so any deployment of the plugin in that range should be considered at risk.

The CVSS score of 9.8 marks this vulnerability as critical. The EPSS score indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits yet. Nevertheless, the attack vector is remotely exploitable via web interfaces that accept untrusted serialized data, and the absence of mitigation measures in the plugin makes it feasible for an attacker to craft a payload and trigger the injection. Given the high severity, organizations should treat this as a high‑priority risk.