The vulnerability involves deserialization of untrusted data, allowing an attacker to inject PHP objects into the WordPress WP Maintenance plugin. This can lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected WordPress site. It is a PHP deserialization flaw identified as CWE-502.

The WordPress WP Maintenance plugin by Florent Maillefaud is affected, specifically all releases from the earliest published version up to and including 6.1.9.7.

The CVSS score of 7.2 classifies the flaw as high severity, but the EPSS score indicates exploitation probability below 1%, suggesting it is rarely targeted. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw by sending a crafted serialized object to the plugin’s input processing endpoint, potentially achieving remote code execution without requiring authentication. The actual attack vector would depend on the plugin’s exposed interfaces.