The vulnerability is a deserialization of untrusted data found in the ThemeFusion Fusion Builder plugin up to version 3.15.3. Attackers can craft serialized objects that the plugin deserializes, enabling object injection that can lead to arbitrary code execution on the WordPress site. The weakness is classified as CWE-502 and can compromise confidentiality, integrity, and availability of the entire site if exploited.

WordPress sites that use the ThemeFusion Fusion Builder plugin version 3.15.3 or earlier are affected. This includes all installations where the plugin version string shows 3.15.3 or any lower patchlevel.

The CVSS base score is 8.8, indicating high severity. The EPSS score of less than 1% suggests a low exploitation probability at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the exploitation path requires an attacker to supply malicious serialized data to the plugin, most likely via an HTTP request to a WordPress endpoint that processes Fusion Builder settings. If such a vector exists, the attacker can gain remote code execution with the privileges of the web server user.