The vulnerability resides in raoinfotech’s GSheets Connector for WordPress, where untrusted data is deserialized without proper validation, enabling PHP object injection. An attacker who can supply crafted data may instantiate arbitrary PHP objects, leading to execution of malicious code, data exfiltration, or modification of system files. This results in loss of confidentiality, integrity, and potential availability due to background tasks or configuration changes.

Affected installations include all versions of GSheets Connector up to and including 1.1.1 deployed on a WordPress site. The product is distributed by raoinfotech and is commonly used to sync spreadsheets with WordPress. Any site running a vulnerable version is exposed.

According to the CVSS score of 7.2, the flaw is considered high severity, though the EPSS score indicates a low exploitation probability (<1%) and the issue is not listed in CISA’s KEV catalog. The likely attack vector is an HTTP request to a plugin endpoint that accepts serialized data, which an attacker can manipulate from an external web request. While the vulnerability is not active in KEV, the remote code execution potential warrants prioritizing remediation.