The GS Plugins WordPress Team Members – GS Plugins plugin allows a PHP Object Injection flaw due to deserialization of untrusted data. An attacker who can supply malicious serialized input to the plugin can create or manipulate PHP objects, enabling arbitrary code execution on the affected WordPress site. This leads to compromise of confidentiality, integrity, and availability of the entire WordPress installation.

All WordPress sites installing GS Plugins WordPress Team Members – GS Plugins up to and including version 2.8.2 are affected. The issue is present in all earlier revisions as well. Only the latest releases (2.8.3 and newer) are considered fixed.

The CVSS score of 8.8 indicates a high severity vulnerability. While no EPSS data is currently available, the nature of this object injection flaw makes it potentially exploitable over the network if the plugin processes data without strong validation. The vulnerability is not listed in CISA’s KEV catalog, suggesting that mass exploitation has not been observed yet, but the attack pathway remains plausible if an attacker can control the serialized payload through the plugin’s interfaces. To exploit, an attacker would need to deliver crafted serialized data that, when deserialized by the plugin, instantiates arbitrary objects, enabling remote code execution.