The vulnerability stems from deserialization of untrusted data within the Phoenix Media Rename plugin, allowing attackers to supply crafted payloads that instantiate arbitrary PHP objects. This flaw, identified as CWE‑502, can enable remote or arbitrary code execution on WordPress sites that have the plugin installed. The insecure deserialization process does not validate or sanitize inputs, providing a direct path for malicious code injection.

All versions of the crossi72 Phoenix Media Rename plugin up to and including 3.13.5 are affected. WordPress installations that use any release from the earliest version through 3.13.5 should be considered vulnerable unless the plugin has been updated to a later release that contains the fix.

The CVSS score of 8.8 indicates a high severity flaw, and although an EPSS score is not available, the lack of listing in CISA KEV does not reduce the urgency of remediation. The most likely attack vector is through the plugin’s public-facing API that accepts serialized data in HTTP requests, enabling an attacker to trigger the vulnerable deserialization logic and exploit the Object Injection flaw.