PHP Object Injection was discovered in the WordPress Zippy plugin versions 1.7.0 and earlier. The flaw allows an attacker to manipulate PHP object deserialization, potentially creating arbitrary objects that can execute malicious code on the server. This vulnerability falls under CWE-502 and could enable remote code execution, data leakage, or other destructive actions if exploited.

The affected system is any WordPress installation that has the Gesundheit Bewegt GmbH Zippy plugin installed at version 1.7.0 or earlier. No specific WordPress core version is given, but the plugin itself is the source of the vulnerability.

The CVSS score of 7.2 indicates a high severity, though the EPSS score is unavailable, so the estimated exploitation probability cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. Attackers likely need to target the plugin’s editor endpoint with crafted input to trigger the injection; thus the attack vector is remote via HTTP requests to the WordPress site. If the site is publicly accessible and the endpoint does not enforce proper authentication, exploitation is feasible.