Deserialization of untrusted data in PickPlugins Post Grid and Gutenberg Blocks allows an attacker to craft a malicious payload that triggers PHP object injection. The flaw is a classic CWE‑502 serialization vulnerability that can lead to remote code execution or unauthorized code execution, compromising data integrity and site availability.

The vulnerability affects the Post Grid and Gutenberg Blocks plugin from PickPlugins, for all releases up to and including version 2.3.11. No later version details are provided.

The CVSS score of 8.8 classifies the flaw as high severity, and the EPSS score of less than 1% suggests that exploitation is currently rare or unlikely, though not impossible. The plugin does not appear in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker supplying crafted serialized data, possibly through a specially formed HTTP request to the plugin’s processing endpoint, which is then deserialized without proper validation.