The vulnerability is a PHP Object Injection flaw present in the Finale Lite WordPress plugin versions up to 2.21.0. This weakness, classified as CWE-502, allows an attacker to manipulate object serialization and potentially execute arbitrary code on the web server. For site owners, exploitation could compromise the entire WordPress installation, granting attackers full control over the website’s files and databases.

The affected product is the Finale Lite plugin sold by Daman Jeet. Any WordPress site running Finale Lite version 2.21.0 or older is vulnerable.

The CVSS score of 7.2 indicates high severity. While the EPSS score is not available, the lack of a KEV listing suggests no widespread exploitation yet, yet the attack vector remains remote, leveraging the web interface of a WordPress site. An attacker would need to interact with the plugin’s shop manager functionality, possibly through crafted HTTP requests, to inject malicious objects.