The vulnerability is a deserialization of untrusted data in the WpEvently plugin that allows an attacker to craft a serialized PHP object and trigger Object Injection. This flaw can lead to remote code execution or modification of site data, depending on the remote code path the attacker can control. The weakness is classified as CWE‑502.

All WordPress sites that installed the WpEvently plugin from the first release up to version 4.3.6, which is maintained by magepeopleteam. Sites using any earlier or later release are unaffected. The plugin is available on the WordPress plugin repository.

With a CVSS score of 8.8, the flaw is considered High severity. The EPSS score of <1 % indicates a currently low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through web requests that provide serialized data to the plugin, such as form submissions or URL parameters, though further analysis is required to determine authentication or privilege prerequisites. If exploited, the attacker could execute arbitrary code on the server.