The vulnerability is a deserialization of untrusted data flaw in PickPlugins Question Answer that enables PHP Object Injection. This flaw allows an attacker to craft malicious payloads that, when deserialized by the plugin, can lead to remote code execution on the WordPress site. The weakness is identified as CWE‑502 (Deserialization of Untrusted Data).

All installations of PickPlugins WordPress Question Answer plugin from the initial release up to version 1.2.73 are potentially affected. The plugin is common in WordPress sites that host community Q&A features.

The CVSS score of 8.8 indicates a high‑severity vulnerability, while the EPSS score of less than 1% suggests that exploitation is currently considered unlikely, yet not impossible. The vulnerability is not listed in CISA KEV, indicating no widespread actively exploited incidents have been reported, but PHP Object Injection can provide an attacker with arbitrary code execution, warranting careful attention.