The vulnerability allows a contributor or higher level user to submit untrusted input to the wpt_schema_breadcrumbs shortcode, which the plugin unserializes without proper validation. This causes PHP object instantiation that can be controlled by the attacker. While the plugin itself has no built‑in POStionally-Overridden-Object chain, the potential for severe impact is realized only when an additional plugin or theme contains such a chain. When that condition is met, the attacker could delete files, exfiltrate data, or execute arbitrary code depending on the chain exposed.

The affected vendor is wpt00ls and the product is Schema Plugin For Divi, Gutenberg & Shortcodes. Versions up to and including 4.3.2 are vulnerable. No further version information is provided, so any release equal to or earlier than 4.3.2 is at risk.

The CVSS score of 6.3 indicates a moderate severity whose impact is limited by the need for a supplemental POP chain. The EPSS score of < 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, authenticated attackers with Contributor privileges can instantiate objects via the shortcode; if a compatible POP chain is present, they may achieve file deletion, data theft, or code execution. The likely attack vector is authenticated, and the vulnerability requires that a POStionally-Overridden-Object chain be available on the target site.