The enhancement of the Awesome Support WordPress plugin is susceptible to deserialization of untrusted data, which permits object injection. This weakness, characterized by the CWE-502 category, enables an attacker to inject arbitrary serialized objects that may be instantiated by the plugin, potentially leading to arbitrary code execution or unauthorized privilege escalation within the WordPress environment.

The vulnerability affects all installations of the Awesome Support WordPress plugin up to and including version 6.3.5. No specific earlier versions are listed, but the issue is present from the initial release through 6.3.5.

The CVSS score of 7.2 indicates a high severity impact, while the EPSS score of less than 1% suggests that exploitation is relatively unlikely at present. The vulnerability is not listed in CISA's KEV catalog. Exploitation would likely occur via the plugin's processing of externally submitted data—such as form entries or API requests—requiring remote delivery of malicious serialized payloads. Consequently, the risk remains significant because the potential loss of compromise could be severe, even if current exploitation attempts are low.