Deserialization of untrusted data in ZoomSounds permits PHP object injection, enabling an attacker to craft serialized payloads that, when processed, can instantiate arbitrary PHP objects. Based on the description, it is inferred that this flaw can lead to remote code execution, data tampering, or information disclosure. The weakness is identified as CWE-502.

ZoomIt:ZoomSounds plugin for WordPress versions up to and including 6.91 is impacted. The vulnerability applies to any WordPress site that installs the plugin at v6.91 or earlier; no explicit version gaps are mentioned.

The CVSS score of 9.8 signals critical severity, and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers would need to deliver a crafted serialized object to the plugin, likely through a public‑facing endpoint that accepts input, implying remote exploitation is feasible if the plugin processes external data without validation.