Deserialization of untrusted data in ThimPress Course Builder versions older than 3.6.6 permits object injection, which can lead to arbitrary code execution. An attacker can construct malicious payloads that, when processed by the plugin, instantiate objects with freely controlled properties, enabling them to execute commands, exfiltrate data, or modify site functionality. The vulnerability threatens confidentiality, integrity, and availability of the affected WordPress site.

WordPress sites using the ThimPress Course Builder plugin. All releases of the plugin prior to version 3.6.6 are vulnerable. This includes any instance where the plugin is installed and active, regardless of site role or user level.

The CVSS score of 9.8 demonstrates a critical impact potential. The EPSS score of less than 1% indicates that, at the time of this analysis, exploitation probability is low, but the lack of a known exploitation framework or CISA KEV listing means the vulnerability could remain under the radar until a zero‑day manifestation occurs. The attack vector is inferred to be remote via crafted HTTP requests that trigger the plugin’s deserialization logic, enabling attackers to inject arbitrary objects and execute code on the server.