The plugin deserializes data from untrusted sources, allowing attackers to inject PHP objects and ultimately execute arbitrary code. This flaw is classified as a deserialization error (CWE‑502) and can lead to full compromise of the WordPress instance, including data theft, defacement, or lateral movement.

The vulnerability affects the WordPress plugin "Small Package Quotes – USPS Edition" produced by enituretechnology, versions from the initial release through 1.3.9. Any site with one of these versions installed is at risk.

The CVSS score of 7.2 indicates moderate to high severity, while the EPSS score of less than 1 % suggests low exploitation probability currently. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an attacker to deliver a crafted serialized payload that the plugin unserializes; this can be done through any input the plugin accepts, such as form fields or API endpoints that pass unchecked data to PHP's unserialize function. Successful exploitation would provide the attacker with the ability to run arbitrary code on the hosting server.