The flaw originates from deserialization of untrusted data within the Sign‑up Sheets plugin, which permits PHP object injection. This weakness, identified as CWE‑502, allows an attacker to craft arbitrary serialized objects that, when processed, can alter object state or execute code within the web application context. The consequence is the potential for full remote code execution, exposing sensitive data, compromising site integrity, and enabling persistence.

All installations of Fetch Designs Sign‑up Sheets from its earliest releases through version 2.3.2 are vulnerable. WordPress sites that have not upgraded beyond 2.3.2 expose the plugin to this exploitation risk.

With a CVSS score of 9.8 the vulnerability is classified as critical, though an EPSS score below 1% indicates the likelihood of exploitation remains low. It is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the probable attack vector is an HTTP request—either via a GET or POST parameter or an internal API call—to the plugin’s endpoint, wherein the attacker supplies a malicious serialized payload. Because remote code execution is possible, administrators should consider the threat high and remediate without delay.