Deserialization of untrusted data in the PickPlugins Accordion plugin allows arbitrary PHP object injection, which can be leveraged by an attacker to execute arbitrary code on the host web server. An exploit that successfully injects a crafted object would break the integrity of the application, potentially giving full control over the affected WordPress site.

The vulnerability affects the PickPlugins Accordion plugin for WordPress, versions up through 2.3.11 inclusive. Any site running that or earlier releases of the plugin is susceptible.

The CVSS v3.1 score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an HTTP request containing a serialized object that the plugin deserializes, so an attacker can remotely supply the payload without needing prior access to the site.