The vulnerability is a deserialization flaw that allows an attacker to inject malicious objects into the TF Woo Product Grid Addon For Elementor plugin. This flaw can lead to the execution of arbitrary code within the context of the WordPress site, exposing confidential data, compromising site integrity, or enabling full takeover of the affected system. The weakness is classified as CWE-502, deserialization of untrusted data.

The problem affects the Themesflat TF Woo Product Grid Addon For Elementor plugin, specifically all releases through version 1.0.1. Users who have not upgraded past this version remain vulnerable.

The CVSS score of 9.8 marks the flaw as critical. The EPSS score of less than 1% indicates a low exploitation probability at this time, and the vulnerability is not present in the CISA KEV catalog. The likely attack vector is through any pathway that allows an attacker to supply and trigger deserialization of data – for example, by accessing a specially crafted URL or payload that the plugin processes. Although public exploits have not yet been observed, the high severity rating warrants immediate action.