The flaw occurs when untrusted data is deserialized, allowing malicious actors to inject arbitrary PHP objects via the FluentCommunity plugin. This PHP Object Injection (CWE‑502) can lead to remote code execution or other destructive actions if an attacker can forge the serialized payload. The vulnerability arises because the plugin does not validate or sanitize data before passing it to unserialize, giving an attacker complete control over the deserialized object graph.

Shahjahan Jewel’s FluentCommunity WordPress plugin, versions up through 1.2.15, are affected. Any WordPress site that installs or maintains this plugin version is at risk.

The CVSS score of 9.8 marks it as Critical, yet the EPSS score of less than 1% suggests low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog, indicating no widely known public exploits. The likely attack vector is via any input that the plugin accepts, such as callbacks or API requests, which the plugin deserializes without validation. An attacker who can send crafted requests could trigger object injection and potentially execute arbitrary code on the host.