The vulnerability is a deserialization flaw that permits PHP object injection. An attacker can supply malicious serialized data to the Foodbakery Sticky Cart plugin, causing the code to instantiate objects with attacker‑supplied values. This can lead to arbitrary code execution and compromise the entire WordPress site. The weakness is classified as CWE‑502: Deserialization of Untrusted Data.

The affected product is Chimpstudio Foodbakery Sticky Cart, a WordPress plugin intended to add a sticky cart feature. Versions from the earliest release through 3.2, inclusive, are vulnerable; newer releases contain a patch that removes the insecure deserialization.

The assigned CVSS score of 9.8 marks this issue as critical. The EPSS score of less than 1% suggests that, as of the last assessment, exploitation attempts are rare, yet the potential impact is severe. The vulnerability is not listed in the CISA KEV catalog, but organizations should not rely on this status for risk mitigation. Attackers are inferred to be able to inject data via HTTP requests that trigger deserialization within the plugin, and because the flaw arises from handling untrusted input, authentication is not strictly required, implying a potential for exploitation without prior access.