Deserialization of untrusted data in the WP Tabs plugin allows PHP object injection, a weakness that could enable an attacker to instantiate malicious objects and execute arbitrary code on the server. The flaw is a typical CWE‑502 (Deserialization of Untrusted Data) and can compromise confidentiality, integrity, and availability of the affected WordPress site if exploited.

The ShapedPlugin LLC WordPress widget WP Tabs (wp‑expand‑tabs‑free) is affected. Any installation running version 2.2.12 or older is vulnerable; versions up to and including 2.2.12 are listed as impacted.

The CVSS score of 7.2 labels the vulnerability as high severity. Its EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not included in the CISA KEV catalog. The likely attack vector is through the WordPress interface that accepts untrusted input, where an attacker could craft data that triggers the unserialize logic. If the action is not mitigated, the risk of achieving remote code execution remains significant.