The vulnerability is a deserialization flaw that permits object injection when untrusted data is processed by the WooCommerce Vehicle Parts Finder plugin. An attacker who can supply crafted serialized input could cause the plugin to instantiate arbitrary PHP objects, leading to arbitrary code execution on the web server. The flaw resides in the plugin's handling of serialized data during normal operation and could be leveraged in a manner that compromises the confidentiality, integrity, and availability of the affected WordPress installation.

The flaw affects the WooCommerce Vehicle Parts Finder plugin from wpinstinct, versions up to and including 3.7. Sites that use this plugin without applying the latest update are at risk. No other vendors or products are affected according to the CNA.

The CVSS score of 9.8 indicates critical severity, yet the EPSS score is below 1%, suggesting that widespread exploitation has not been observed. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would likely target the plugin via HTTP requests that deliver serialized data; however, the exact entry point is not specified in the advisory, so the vector is inferred.