A deserialization flaw in the WordPress GS Pins for Pinterest plugin allows untrusted data to be processed as PHP objects. This PHP Object Injection can lead to arbitrary code execution if an attacker can influence the serialized payload that the plugin accepts. The weakness is classified as CWE-502, indicating a failure to safely handle serialized objects.

The vulnerability impacts the GS Pins for Pinterest plugin by GS Plugins, affecting all versions from the earliest available release through 1.9.2. Versions 1.9.3 and later contain the fix and are not affected.

The CVSS score of 8.8 ranks the flaw as High severity. EPSS data is not provided, so the precise probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted serialized payload, likely via a plugin input field or user-provided data, to trigger the deserialization. The patch removes the vulnerable code path, rendering the injection impossible.