The vulnerability is a deserialization of untrusted data flaw that allows object injection. An attacker who can supply crafted serialized payloads to the Social Counter plugin can have the plugin instantiate malicious objects and execute arbitrary PHP code. The result can be a full compromise of the affected WordPress site; however, the CVE description does not specify whether authentication is required, so it is inferred that access to the vulnerable function is needed but the exact authentication requirements are unknown.

WordPress users running the Prisna Social Counter plugin up to and including version 2.0.5 are impacted. No other versions or plugins are mentioned in the advisory.

The CVSS score of 7.2 indicates a high risk, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. Because the function that processes serialized data is exposed through the web interface, the likely attack vector is web‑based. The vulnerability is not listed in the CISA KEV catalog, so there is no known widespread exploitation at this time.