The flaw is a PHP object injection vulnerability arising from deserialization of untrusted data within the Pagaleve Pix 4x sem juros WordPress plugin, allowing an attacker to inject malicious serialized objects. The weakness is classified as CWE-502: Deserialization of Untrusted Data. The vulnerability may enable arbitrary code execution on the server, which could result in full compromise of the affected WordPress site, but this is inferred from the description.

Any installation of the Pagaleve Pix 4x sem juros – Pagaleve plugin running version 1.6.9 or earlier is affected. The vendor references versions from unknown through 1.6.9 as vulnerable, with no other products or vendors listed.

The CVSS score of 9.8 reflects extreme severity, while the EPSS score of fewer than 1% indicates a low current exploitation likelihood. The vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that exploitation would involve sending a crafted serialized payload to an endpoint that processes user input, allowing an attacker to achieve remote code execution or system takeover.