Deserialization of untrusted data within the Content Egg plugin enables PHP Object Injection, allowing an attacker to craft crafted serialized objects that may result in arbitrary code execution or other destructive actions if the injected object triggers malicious PHP code. This weakness is classified as CWE‑502 and can compromise the confidentiality, integrity, and availability of the affected WordPress site.

The vulnerability exists in the Content Egg plugin for WordPress provided by Keywordrush, affecting all releases from the earliest version up through version 7.0.0. Users running any of these versions are therefore exposed.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1 % suggests a low current likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Likely exploitation would occur via a web-based attack path where an attacker can supply serialized data to the plugin, typically through unauthenticated or authenticated input forms provided by the plugin.