The Product Feed Manager plugin through version 7.14.1 contains a PHP Object Injection vulnerability that allows an attacker to send a crafted serialized object to the exposed functionality. When this object is deserialized by the plugin, arbitrary PHP code can be executed, leading to full compromise of the site. This flaw is identified as CWE‑502 and results in a loss of confidentiality, integrity and availability of the affected WordPress installation.

The Vendor RexTheme’s Product Feed Manager plugin is affected. Any instance of the plugin at versions 7.14.1 or earlier running on WordPress is susceptible to exploitation.

The CVSS score for this vulnerability is 7.2, indicating a high severity. The EPSS score is currently unavailable, and it is not listed in the CISA KEV catalog. The likely attack vector is an externally accessible HTTP request that includes a malicious serialized payload. If successfully exploited, an attacker can execute arbitrary PHP code on the web server.