The plugin suffers from deserialization of untrusted data, allowing an attacker to inject crafted PHP objects that are unserialized by the application. This object injection can lead to the execution of arbitrary code, thereby compromising the confidentiality, integrity, and availability of the host system. The weakness is a classic deserialization vulnerability classified as CWE-502.

WordPress sites that have installed the add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder plugin, from the earliest release up through version 6.5.0. Any site using this plugin in those versions is potentially exposed and must verify or update their plugin installation.

The CVSS score of 8.8 indicates a high severity. The EPSS score of less than 1% suggests that industry-wide exploitation is currently uncommon, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a remote requester able to trigger the plugin’s deserialization routine, such as through crafted form submissions or direct API calls. If successful, the attacker could gain full control over the affected WordPress site.