The vulnerability is a PHP Object Injection flaw in the Shop manager component of the FV Flowplayer Video Player plugin for WordPress, affecting all releases up to and including 8.3.4. By manipulating user-supplied data, an attacker can cause PHP to instantiate arbitrary objects, potentially leading to arbitrary code execution. This would allow the attacker to compromise the confidentiality, integrity, and availability of the WordPress installation, and could be leveraged to gain full control of the compromised site.

The flaw impacts the FolioVision FV Flowplayer Video Player plugin for WordPress, specifically all versions up to 8.3.4. Systems running those versions are vulnerable; newer releases are not affected.

The CVSS score of 7.2 indicates a high severity, and while an EPSS score is not provided, the lack of a KEV listing suggests that widespread exploitation may not yet be observed. The likely attack vector is a remote web‑based attack where the attacker supplies crafted input to the shop manager interface. If the plugin is exposed to the public, an unauthenticated attacker could exploit the flaw without additional requirements. The risk is therefore significant for sites that continue to use the vulnerable plugin version.