Deserialization of untrusted data in the WPBot Pro Wordpress Chatbot plugin permits PHP object injection, a form of code injection that can allow an attacker to execute arbitrary PHP code on a WordPress site. This weakness is classified as CWE-502 and is the main root of the vulnerability. An attacker who can trigger a deserialization event can gain full control of the affected web server, potentially leading to data exfiltration, site defacement, or the deployment of additional malicious payloads.

The issue affects the QuantumCloud WPBot Pro Wordpress Chatbot plugin for WordPress versions 12.7.0 and earlier. No other vendors or products are listed as impacted.

The CVSS score of 9.8 marks this vulnerability as critical, yet the EPSS score of < 1% indicates that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote through a crafted HTTP request that causes the plugin to deserialize untrusted input. An attacker would need to send specially crafted data that reaches the deserialization routine, which is possible via public plugin interfaces such as chat or form submissions.