The vulnerability is a PHP Object Injection flaw present in the Shop Manager component of Product Catalog Feed by PixelYourSite versions up to 3.1.4. It allows an attacker to inject malicious PHP objects, which can lead to arbitrary code execution within the context of the affected WordPress site. Because the vulnerability is tied to object serialization handling (CWE‑502), an attacker could manipulate objects to gain unauthorized control, modify data, or compromise the entire site.

The affected product is the WordPress plugin Product Catalog Feed by PixelYourSite from the vendor PixelYourSite. Vulnerable versions are 3.1.4 and earlier.

The CVSS score of 7.2 classifies the weakness as high severity. The EPSS score is not available, so the current exploitation probability is unknown. It is not listed in the CISA KEV catalog. The vulnerability is exploitable remotely, likely via crafted HTTP requests that target the plugin’s shop manager endpoints. If the attacker can inject crafted serialized data, the flaw could be triggered without additional privileges, though administrative access may be required depending on the plugin configuration.