The vulnerability arises from deserialization of untrusted data, enabling PHP object injection. An attacker can craft a serialized object to execute arbitrary code on the server, compromising confidentiality, integrity, and availability. The flaw is a classic instance of CWE‑502: Deserialization of Untrusted Data.

The fault affects the WordPress eCommerce Product Catalog plugin from impleCode. All installations using versions 3.4.3 or older are vulnerable, with the exposed range stated as from n/a through <=3.4.3.

The CVSS score of 7.2 indicates a high severity flaw. The EPSS score of less than 1% shows very low probability of exploitation at present, and the issue is not listed in CISA KEV. Nonetheless, the potential for remote code execution, combined with the fact that the plugin is widely deployed on WordPress sites, warrants prompt action. The likely attack vector is through a crafted HTTP request that triggers the plugin’s deserialization routine; this inference is based on the nature of PHP object injection in WordPress plugins.