A deserialization of untrusted data flaw in the WPSpeedo Team Members plugin enables attackers to perform object injection. The vulnerability, classified as CWE‑502, allows a malicious payload containing a crafted PHP object to be deserialized by the plugin. If successfully exploited, an attacker could gain full control over the WordPress site, leading to arbitrary code execution, data theft, and system compromise.

The flaw affects all versions of the WordPress Team Members plugin up to and including version 3.4.4, distributed by WPSpeedo.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an attacker can submit a crafted serialized object through the plugin’s data handling endpoints, possibly via a POST request. The plugin then deserializes the data without proper validation, enabling code execution. No official workaround has been released.