TotalSuite’s TotalContest Lite plugin processes serialized data without validating its source, creating a deserialization weakness that permits attackers to inject arbitrary PHP objects. The vulnerability can be exploited to craft a malicious payload that, when the plugin deserializes it, may execute code on the web server or manipulate application data, compromising confidentiality, integrity, and availability of the affected WordPress site.

WordPress sites that use the TotalContest Lite plugin version 2.9.1 or earlier are at risk. The plugin is distributed by TotalSuite and is commonly named TotalContest Lite in plugin directories.

The EPSS score indicates a very low probability (<1%) that this flaw will be actively exploited in the wild, and it is not cataloged in CISA’s KEV registry. The absence of a publicly disclosed exploit and the requirement for the attacker to supply crafted serialized data suggest that the attack vector is remote and requires some form of user or administrative interaction. Although the immediate risk level is low, the potential impact of Remote Code Execution warrants prompt attention.