A deserialization flaw in the WordPress Acerola plugin permits an attacker to inject arbitrary PHP object data, which can lead to remote code execution, privilege escalation, or other severe consequences. The vulnerability is flagged with a CVSS score of 9.8, indicating a critical level of severity.

WordPress sites that have the themeton Acerola plugin installed, any version up to and including 1.6.5. The vulnerability exists from the earliest release through 1.6.5, so all installations of those plugin versions are affected.

The EPSS score of less than 1% suggests that exploitation is currently unlikely, but the high CVSS score and the nature of the flaw mean that a remote attacker could potentially craft malicious serialized data and deliver it via a web request to the vulnerable plugin. The vulnerability is not listed in CISA's KEV catalog, but the combination of a critical severity score and the possibility of remote exploitation makes it a priority for immediate action.