This vulnerability allows an attacker to inject arbitrary PHP objects through deserialization of untrusted data. Object injection can lead to remote code execution, arbitrary file inclusion, or other destructive actions by manipulating the object's properties. The flaw is based on improper handling of serialized objects, a weakness captured by CWE-502. The impact is high, as it can undermine the confidentiality, integrity and availability of the affected website.

The issue affects the WordPress plugin FoodBakery published by Chimpstudio, from version n/a up to and including 3.3. Any WordPress site running a vulnerable instance of this plugin is at risk.

The CVSS score of 9.8 indicates Critical severity, while the EPSS score of < 1% suggests a low current exploitation likelihood. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector involves an attacker crafting a malicious payload that is sent to the site via an HTTP request, which the plugin then deserializes without proper validation.