The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in the Flickr Shortcode Importer plugin. Attackers who can craft a malicious serialized object and cause it to be processed by the plugin may achieve arbitrary code execution on the server where the WordPress site runs. This issue is classified as CWE‑502 and carries a CVSS score of 7.2, indicating high severity.

The affected software is the Flickr Shortcode Importer plugin developed by Michael Cannon. All releases from the very first version up to and including version 2.2.3 are vulnerable. WordPress sites that host the plugin and serve content over HTTP(S) are at risk because the flaw exists in the plugin’s core code.

The EPSS score is reported as <1%, which indicates a low but non‑zero likelihood that adversaries will target this weakness in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring only that an attacker can send crafted serialized data to the plugin, for example via a URL query parameter or a form submission. Assuming a successful exploit, the attacker would be able to execute arbitrary PHP code through the deserialization path and potentially gain full control of the hosting environment.