The vulnerability is a deserialization flaw that permits object injection in the eDS Responsive Menu plugin. When an attacker supplies specially crafted serialized data, the plugin may instantiate or modify objects, potentially leading to unintended code execution or manipulation. The weakness is identified as CWE-502. No explicit confirmation of remote code execution is provided, but the flaw permits arbitrary object manipulation.

All releases of the aThemeArt Translations eDS Responsive Menu plugin up to version 1.2 on WordPress are vulnerable. The issue impacts every instance of the plugin installed on WordPress, regardless of the host environment.

The CVSS score of 7.2 indicates moderate to high severity, while an EPSS score under 1 % suggests a low likelihood of current exploitation. The flaw is not included in the CISA KEV list. Attackers would likely need to interact with the plugin’s configuration or request endpoints that process serialized input; this involves either unauthenticated or authenticated access, as the description does not specify. The exploit requires crafting a malicious serialized payload that, when deserialized by the plugin, performs the injected object action.