The Nexter Extension – Site Enhancements Toolkit plugin for WordPress allows unauthenticated attackers to inject arbitrary PHP objects through the 'nxt_unserialize_replace' function via deserialization of untrusted input. This flaw is a classic PHP Object Injection that uses CWE‑502, which can lead to data leakage, file manipulation, or code execution if a suitable PHP Object Persistence (POP) chain exists elsewhere on the site. The vulnerability alone does not provide a direct attack path, but its presence can be leveraged in conjunction with other plugins or themes that contain exploitable POP chains.

WordPress sites running the posimyththemes Nexter Extension – Site Enhancements Toolkit plugin, version 4.4.6 or earlier, are affected. All releases up to and including 4.4.6 contain the vulnerable 'nxt_unserialize_replace' implementation.

The CVSS score of 8.1 indicates high severity, though the EPSS score is below 1% and the flaw is not listed in the CISA KEV catalog, suggesting low likelihood of widespread exploitation. Attackers would need to craft serialized payloads and send them to the plugin’s endpoint without authentication, then rely on a POP chain supplied by another plugin or theme. If such a chain is present, the attacker could delete files, read sensitive data, or execute arbitrary code. Without a POP chain, the vulnerability remains non-exploitable on its own.