Deserialization of untrusted data in the WordPress WP Store Locator plugin allows attackers to inject arbitrary PHP objects. This object injection can lead to remote code execution on the web server that hosts the site. The flaw is a classic Deserialization of Untrusted Data weakness (CWE‑502) where unsanitized input is passed to PHP's unserialize() function, creating a high impact attack surface.

The vulnerability affects all installations of the WP Store Locator plugin up to and including version 2.2.260. Users running any WordPress site with this plugin, regardless of the theme or other plugins, may be impacted. The issue is present from the first available version through 2.2.260.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of less than 1% shows a low exploitation probability at the current time. The weakness is classed as a PHP Object Injection, which an attacker could trigger by supplying crafted serialized data via any input that the plugin processes. While it is not listed in the CISA KEV catalog, the potential for arbitrary code execution makes it a critical threat, especially for exposed websites. Basic defensive checks such as input validation or sandboxing are insufficient; an exploit would most likely succeed through the normal administrative or front‑end interfaces that accept serialized data.