The vulnerability is a PHP Object Injection flaw that arises from deserialization of untrusted data in the GoodLayers Hostel plugin. An attacker can construct a malicious serialized payload that, when processed by the plugin, causes the execution of arbitrary code on the WordPress site, allowing a full compromise. The weakness is identified as CWE‑502, which directly impacts confidentiality, integrity, and availability of the host.

The GoodLayers Hostel plugin, versions up to and including 3.1.2, installed on WordPress sites is affected. Any WordPress installation running these plugin versions is vulnerable.

The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% suggests that widespread exploitation is currently unlikely, yet the flaw permits remote code execution without authentication. The vulnerability is not listed in CISA’s KEV catalog. Attackers can likely exploit the flaw by sending a crafted serialized payload through a public endpoint that initiates deserialization, potentially via an unauthenticated web request to the affected plugin.