HelpGent plugin deserializes data supplied by users without validating the format, creating an Object Injection vector. An attacker can send a crafted serialized PHP object that, when processed by the plugin, executes arbitrary PHP code. This allows full control of the affected WordPress site, leading to data exfiltration, site defacement or worse. The weakness is classified as CWE-502: Deserialization of Untrusted Data.

All installations of the wpWax HelpGent plugin from the earliest version up to and including 2.2.5 are affected. No specific WordPress core or other plugin versions are mentioned, so any WordPress site using HelpGent ≤ 2.2.5 is at risk.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests that exploitation is presently unlikely, though the vulnerability remains available. The vulnerability is not listed in the CISA KEV catalog, meaning that known exploitation has not been reported. Based on the description, the likely attack vector is remote via web requests that trigger the plugin’s deserialization logic, possibly through plugin settings pages or API endpoints. An attacker can craft malicious input, cause object injection, and execute code on the server without authentication, assuming the plugin does not enforce any access controls on the data it deserializes.