The WP Webhooks plugin contains a deserialization flaw that permits PHP object injection through untrusted data handling. This vulnerability, mapped to CWE-502, can allow an attacker to instantiate malicious objects and ultimately execute arbitrary code on the target server. A successful exploitation would compromise the confidentiality, integrity, and availability of the affected WordPress installation.

All installations of the Cozmoslabs WP Webhooks plugin with versions up to and including 3.3.8 are vulnerable. The issue applies from the first released version of the plugin through version 3.3.8. (The exact minimum affected version is not specified.)

The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation attempts are currently rare. The plugin processes serialized data that can be crafted by an attacker, and the vulnerability can be triggered via the plugin’s public interfaces. The likely attack vector is a remote user sending a malicious payload to the plugin’s endpoint; authentication is not required if the endpoint is exposed, but the worst case assumes attacker could leverage the plugin from any authenticated user. This CVE is not listed in the CISA KEV catalog.