The vulnerability is a deserialization of untrusted data flaw that enables object injection in the Link Whisper Free plugin. An attacker that can supply crafted payloads could create arbitrary object instances, potentially leading to arbitrary code execution on the WordPress site.

Link Whisper Inc’s Link Whisper Free plugin, any installation using versions up to and including 0.9.7.

The CVSS score of 9.8 marks the issue as critical, while the EPSS score of less than 1% indicates a low current exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a remote attacker submitting malicious data through the plugin’s exposed interface, which the plugin then unserializes without validation. If exploited, the attacker could run arbitrary code with the privileges of the web server, jeopardizing confidentiality, integrity, and availability of the WordPress installation.