This vulnerability involves unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The flawed deserialization routine in the WP Funnel Manager plugin can be exploited to instantiate arbitrary PHP objects, which may then trigger sensitive internal operations or code execution. Because the deserialization occurs with insufficient validation, an attacker can supply a crafted payload that leads to arbitrary code execution, exposing the entire web application to compromise.

The issue affects the WP Funnel Manager WordPress plugin from its earliest release up to and including version 1.4.0. Any WordPress site that has this plugin installed without a newer version is vulnerable. Site administrators must verify the plugin version and the hosting environment that could facilitate the injection payload.

With a CVSS score of 9.8, this flaw is considered critical, and it is inferred that the vulnerability may be triggered via HTTP requests targeting the plugin’s data processing functions. The EPSS score of less than 1% suggests that widespread exploitation has not yet been observed, but the high severity means that once a valid exploit vector is discovered, the risk is extreme and the attack requires only legitimate input to the plugin. The vulnerability is not presently in the CISA KEV catalog, so no known active exploits have been recorded as of this analysis.