The vulnerability is a cross-site request forgery flaw that permits an attacker to trigger PHP object injection in the ServerBuddy plugin. By sending a forged request that the plugin does not properly verify, an attacker can induce the plugin to instantiate arbitrary PHP objects. In a typical PHP environment, such manipulation can lead to execution of arbitrary code, enabling full compromise of the affected WordPress installation.

The issue impacts the iThemes: ServerBuddy plugin by PluginBuddy.com, specifically all releases from the earliest available version up to and including 1.0.5. No later versions appear to be affected, but the affected range extends to 1.0.5 as the last known vulnerable release.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploit attempts are unlikely to be widespread at present. The vulnerability is not listed in CISA’s KEV catalog, reinforcing that it is not a known active exploit. The likely attack vector is via a web-based CSRF attack, requiring the victim to be a user with rights to trigger the affected plugin action, often an administrator. Once the CSRF request is executed, the injected PHP object can lead to remote code execution.