The vulnerability is a deserialization flaw that permits PHP object injection in the WordPress SureCart plugin. The official description notes that untrusted data is deserialized, enabling an attacker to create arbitrary PHP objects. Based on this description, it is inferred that malicious serialized payloads could trigger unintended code execution; the impact is the potential for full compromise of the hosting server.

All WordPress sites that have the Brainstorm Force SureCart plugin installed in any version up to and including 4.9.3 are affected. The vulnerability applies uniformly to every released minor version in that range, meaning an unpatched installation is vulnerable regardless of the specific minor build.

The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score is below 1 % and it is not listed in CISA's KEV catalog, suggesting limited current exploitation. The likely attack vector is inferred to be a public web request that includes a malicious serialized payload targeting one of the plugin’s input endpoints, such as a form or custom query parameter. Successful exploitation would grant remote code execution and full control over the server.