Contributor PHP Object Injection exists in the Dynamic QR Code – generator plugin for WordPress versions 1.0.1 and earlier. The flaw allows an attacker to inject serialized PHP objects via untrusted input, potentially leading to remote code execution or unauthorized access. The vulnerability is a classic object injection flaw as tracked by CWE-502, and it could compromise the confidentiality, integrity, and availability of the affected site if exploited.

The affected product is the sosidee Dynamic QR Code – generator plugin for WordPress. Versions 1.0.1 and earlier are vulnerable, and any site running these versions inherits the risk.

The CVSS score is 8.8, indicating a high severity risk. The EPSS score is unavailable, and the vulnerability is not listed in KEV, suggesting no currently known exploits but a high potential for exploitation. The attack vector is inferred to be remote via the plugin’s exposed input fields, allowing an attacker to craft malicious serialized objects. The flaw remains exploitable as long as the vulnerable plugin continues to be used.