The vulnerability is a deserialization flaw that permits PHP Object Injection in the WpEvently plugin for WordPress. An attacker can supply crafted serialized data that is parsed by the plugin, potentially leading to arbitrary code execution on the hosting server. The nature of the flaw is a CWE‑502 type vulnerability, which can compromise confidentiality, integrity, and availability of the affected web application.

WordPress sites that have the magepeopleteam WpEvently (mage‑eventpress) plugin with a version of 4.4.8 or earlier are affected. The plugin version information indicates the flaw exists in all releases up to and including 4.4.8.

The CVSS score of 8.8 indicates a high severity level. The EPSS score of less than 1% shows that exploit attempts are statistically unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from the nature of the deserialization flaw and typical WordPress traffic patterns. An attacker would need to supply malicious serialized input to a path processed by the plugin, which is obtainable by interacting with the plugin’s exposed endpoints. The high severity, combined with the possibility of arbitrary code execution, warrants careful attention even though the exploitation probability is low.