This vulnerability is a PHP object injection flaw in the WordPress WP Ticket Customer Service Software & Support Ticket System plugin. During deserialization of data supplied by users, the plugin does not validate or restrict the object types that may be instantiated, allowing an attacker to craft malicious input that can lead to arbitrary code execution. The flaw is classified as CWE‑502.

The vulnerability affects the emarket‑design WP Ticket Customer Service Software & Support Ticket System plugin up to and including version 6.0.2. All installations of the plugin at or below that version are potentially exposed, so any WordPress deployment where the plugin is installed can be impacted.

The flaw carries a CVSS score of 8.1, indicating a high severity. The EPSS score is less than 1%, showing a very low but non‑zero probability of exploitation, and the vulnerability is not currently listed in CISA's KEV catalog. Based on the description, the likely attack vector involves a remote attacker supplying a crafted serialized payload, perhaps via a form or URL parameter, that the plugin will deserialize and instantiate, potentially compromising the server. Precise exploitation details are not provided, but the lack of input validation suggests that the flaw can be abused without privileged access.