The vulnerability is a PHP Object Injection flaw arising from deserialization of untrusted data in the quantumcloud KBx Pro Ultimate WordPress plugin. This issue, classified under CWE‑502, allows an attacker to manipulate the serialized payload executed by the plugin, potentially enabling the injection of arbitrary objects and execution of arbitrary code. If exploited, the attacker could compromise the confidentiality, integrity, and availability of the hosting server and any data processed through the plugin.

Quantumcloud’s KBx Pro Ultimate plugin, versions from n/a through 8.0.5, is affected. The vulnerability is present in the plugin’s handling of deserialized input without proper validation.

The CVSS score of 9.8 demonstrates a critical severity level. The EPSS score is reported as < 1 %, indicating a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves submitting a crafted serialized payload via a web request to the plugin’s deserialization endpoint, which, if successful, could lead to remote code execution. No explicit mitigations are documented beyond patching, so the risk remains high if the plugin remains installed and unpatched.