The myPOS Checkout plugin for WordPress contains a PHP Object Injection vulnerability affecting versions 1.4.5 and earlier. This flaw allows a malicious actor to craft a payload that deserializes into a tainted object, potentially leading to arbitrary code execution on the server. The weakness is identified as CWE-502 and can compromise the confidentiality, integrity, and availability of the host system if exploited

The vulnerability impacts the myPOS Payments:myPOS Checkout plugin for WordPress, specifically all releases up to and including 1.4.5

With a CVSS score of 7.2 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through crafted HTTP requests that trigger the checkout process, possibly requiring authenticated shop manager access. As such, the risk is focused on administrators who can submit shop manager forms, but the impact of exploitation is broad once the vulnerability is triggered.