The vulnerability is a PHP Object Injection flaw in the News Kit Elementor Addons plugin for WordPress, affecting all versions up to and including 1.5.0. The flaw allows an attacker to manipulate serialized PHP objects that the plugin processes when handling subscriber data, potentially enabling arbitrary code execution on the host system.

The flaw is limited to installations of Blazethemes' News Kit Elementor Addons plugin version 1.5.0 and earlier. WordPress sites that have deployed these plugin releases, regardless of theme or hosting provider, are at risk.

The CVSS score of 8.8 indicates high severity. While an EPSS score is not available, the lack of a KEV listing does not negate that this vulnerability can be exploited. Based on the description, it is inferred that exploitation likely requires the attacker to send a specially crafted request to the plugin’s subscriber handling endpoint, accessible to any visitor with sufficient privileges to submit subscriber data. If the endpoint is publicly exposed, the likely attack vector becomes a remote, unauthenticated request. Organizations should treat this as a serious risk until a patch is applied.