The Preserve Code Formatting plugin contains a flaw where untrusted data is deserialized without proper validation, enabling PHP Object Injection. This leads to the possibility of arbitrary code execution or manipulation of the plugin’s internal state. Since the vulnerability lies in the core data handling routine, compromised data can affect the confidentiality, integrity, and availability of the WordPress site.

Scott Reilly’s Preserve Code Formatting plugin for WordPress, versions from the original release through 4.0.1 inclusive, is impacted. Any WordPress installation using these plugin versions is at risk, and the flaw has not been reported in the CISA KEV catalog.

The CVSS score of 8.8 marks this vulnerability as high severity. The EPSS score of less than 1% indicates a low current probability of exploitation, and the lack of an KEV listing suggests no publicly recorded exploitation yet. The attack vector is most likely web-based, with an attacker sending a malicious serialized payload via the plugin’s input mechanisms such as a form or API endpoint.