The vulnerability is a prototype pollution flaw that allows an unauthenticated user to submit prototype-sensitive field paths when the Payload Import Export plugin is enabled, leading to unintended application behavior and remote code execution. The weakness is classified as CWE-1321.

The vulnerability affects the Payload CMS system, specifically the @payloadcms:plugin-import-export and payloadcms:payload products. Version ranges impacted are 3.0.0 up to but not including 3.88.0, and canary releases prior to 4.0.0-canary.27.

With a CVSS score of 9.3, the flaw represents a high severity risk. The EPSS score is not available, but the lack of KEV listing does not diminish the potential for exploitation. The flaw can be triggered by any unauthenticated user who can submit data to the import/export functionality; this implies that the attack vector is reachable via the public API or endpoints associated with the plugin. Once exploited, the attacker can achieve remote code execution, compromising confidentiality, integrity, and availability of the affected system.