The Universam plugin for WordPress contains a deserialization flaw that allows untrusted data to be processed as PHP objects. This PHP Object Injection vulnerability can enable an attacker to inject arbitrary objects, which may lead to execution of malicious code on the web server. The weakness is formally classified as CWE-502, Deserialization of Untrusted Data.

This issue affects the Universam WordPress plugin, specifically all releases from the earliest available version through version 9.04.02.

With a CVSS score of 9.8 the flaw is considered critical. The EPSS score of less than 1% indicates that, as of now, the probability of observed exploitation is low, yet the impact remains severe if exploited. The vulnerability is not present in CISA’s KEV catalog, meaning no confirmed widespread exploits have been reported, but the remote attack vector is inferred to involve sending a crafted serialized payload to an endpoint that accepts untrusted input from the Universam plugin.