The vulnerability is caused by insecure deserialization of untrusted data in the GoodLayers Goodlayers Hotel gdlr-hotel WordPress plugin. An attacker can inject PHP objects during deserialization, resulting in arbitrary code execution on the server. This leads to complete compromise of the affected site, affecting confidentiality, integrity, and availability.

The plugin GoodLayers Goodlayers Hotel gdlr-hotel is affected. All releases from the initial launch up through version 3.1.4 contain the flaw, so any site running those versions must verify its plugin version and ensure it is updated.

The CVSS score of 9.8 classifies this issue as critical. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is inferred to involve the deserialization of user‑supplied data that the plugin accepts. If an attacker is able to provide crafted serialized PHP objects to this input, they can trigger execution of arbitrary code during object construction. The flaw does not require privileged credentials or specialized network exposure beyond standard access to the WordPress installation, so both remote and local contexts are feasible depending on how the plugin processes inputs.