ConveyThis’s WordPress Translate widget deserializes untrusted data, providing an object injection flaw that enables an attacker to execute arbitrary PHP code on the server and potentially take full control. This type of vulnerability is categorized as CWE‑502 and can directly compromise confidentiality, integrity, and availability of the affected site.

The affected product is the ConveyThis WordPress Translate plugin, maintained by the vendor ConveyThis. All releases from the initial version through and including 269.1 are vulnerable, as the deserialization flaw exists throughout that range. No other products or versions are explicitly listed.

The CVSS score of 7.2 signals a high severity issue, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that attackers could target the plugin through any interface that accepts serialized input, such as the language selection widget or shared translation links, to inject malicious objects remotely.