wp‑shuffle's Subscribe to Download plugin contains PHP object injection via deserialization of untrusted data. An attacker can supply crafted payloads that are deserialized during normal operation, allowing execution of arbitrary PHP code or manipulation of application state. This flaw is a CWE‑502 vulnerability, potentially compromising confidentiality, integrity, or availability of the affected WordPress site.

The vulnerability affects the Subscribe to Download plugin produced by wpshuffle. All released versions up through and including 2.0.9 are impacted. Users running any version of the plugin in that range should be aware of the risk.

The CVSS score of 9.8 indicates high severity. The EPSS score of less than 1% suggests low current exploitation probability, yet the vulnerability remains unlisted in CISA’s KEV catalog. However, the presence of a remote code execution vector, combined with the plugin’s web‑accessible functionality, makes it a prime target for attackers. The likely attack path is via malicious input submitted through the plugin’s public interfaces, which would trigger the unsafe deserialization.