The plugin deserializes untrusted input, allowing attackers to inject crafted PHP objects that are instantiated on the server. This results in server‑side code execution, compromising the integrity and confidentiality of the entire WordPress site, including its database and files.

The vulnerability exists in the WordPress plugin "Rating by BestWebSoft" from any version through 1.7. Attackers can exploit any installation that has an outdated version of this plugin.

The base CVSS score of 8.8 indicates a high severity vulnerability. However, the EPSS score of less than 1% shows a currently very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s ability to accept serialized data from user inputs, meaning a logged‑in user or a user able to influence that input could trigger the flaw. Exploitation requires that the attacker can provide the malicious serialized payload to the plugin’s deserialization routine.