The vulnerability is a deserialization flaw that allows attackers to inject PHP objects via the Filter Everything plugin. When untrusted data is deserialized, an attacker can create malicious objects, leading to arbitrary code execution on the host.

The affected product is stepasyuk's Filter Everything — WordPress & WooCommerce Filters plugin, versions published from the initial release up through 1.9.7. Users running any of these versions on a WordPress site are at risk.

The CVSS score of 7.2 indicates moderate to high severity. EPSS data is unavailable, so exploitation likelihood cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote, with an attacker able to send malicious serialized payloads through the plugin's input endpoints. Successful exploitation would allow execution of arbitrary code on the WordPress server, potentially compromising the entire site.