Technical impact
Deserialization of untrusted data in the Paytium plugin allows an attacker to perform PHP Object Injection. By injecting a crafted serialized object into the plugin’s input processing, an attacker can potentially instantiate arbitrary classes and execute code, leading to full compromise of the WordPress site.
Affected Systems
The affected product is the WordPress Paytium plugin from Paytiumsupport. Versions up to and including 5.0.5 are vulnerable; all versions prior to 5.0.6 include the fix.
Risk and Exploitability
The CVSS score of 9.8 indicates a critical severity. The lack of an EPSS score means the current exploitation probability is unknown, but PHP Object Injection is a well‑known attack vector that can be delivered over the web. The vulnerability is not listed in the CISA KEV catalog yet, indicating it has not yet been identified as a known exploited vulnerability. Attackers can likely deliver malicious payloads through any publicly exposed endpoints that process the plugin’s data, so a remote exploitation path exists.
