The vulnerability arises from the Kleor Contact Manager plugin deserializing untrusted data, enabling an attacker to inject malicious PHP objects. This object injection can allow arbitrary code execution or other unauthorized operations on a WordPress site where the plugin is active. The weakness is classified as CWE‑502.

WordPress sites using the Kleor Contact Manager plugin from any version through 9.1.1 are affected. The vulnerability applies to all installations running these plugin versions.

The CVSS score of 8.8 indicates high severity, while the EPSS of <1% suggests a low current exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector is submission of crafted serialized payloads to the plugin via exposed API or form endpoints, which is inferred from the fact that the plugin deserializes untrusted data. Though no public exploitation evidence exists, the potential impact of remote code execution is significant if an attacker succeeds.