The vulnerability is a PHP Object Injection flaw caused by the deserialization of untrusted data in the Max Chirkov Simple Login Log plugin. The flaw permits an attacker to craft serialized objects that, when processed by the plugin, can lead to the execution of arbitrary PHP code. This type of weakness is classified under CWE‑502 and has the potential to compromise the confidentiality, integrity, and availability of the affected WordPress site.

Max Chirkov’s Simple Login Log plugin is vulnerable in all releases up to and including version 1.1.3. Sites running any version of the plugin within that range are at risk; newer releases beyond 1.1.3 are presumed patched.

The CVSS score of 8.1 places this flaw in the high severity range. The EPSS score indicates a very low, yet non‑zero, probability of exploitation as of the most recent data. The vulnerability is not listed in CISA’s KEV catalog. Given that the flaw requires the deserialization of attacker‑supplied data, the likely attack vector is remote exploitation through crafted requests that the plugin accepts (for example, posting malicious data via the plugin’s form or interface). No explicit authentication requirement is stated in the provided data, so it is inferred that an unauthenticated external attacker may be able to trigger the deserialization if the plugin’s inputs are publicly accessible.