Technical impact
Barn2 Plugins’ Document Library Pro processes serialized data supplied by users. Because the plugin deserializes this data without proper validation, it is vulnerable to PHP Object Injection. An attacker can craft a malicious payload that, when deserialized, creates objects with controlled state, potentially allowing arbitrary PHP code execution within the web application. This weakness is classified as CWE‑502 and has a CVSS score of 9.8, indicating a critical threat.
Affected Systems
All versions of Document Library Pro older than 4.2.2—including 4.2.1 and earlier releases—are affected. Any WordPress site that has this plugin installed is at risk if the plugin’s deserialization logic is triggered by an attacker‑controlled input.
Risk and Exploitability
The CVSS score of 9.8 signals a high exploitation likelihood if the conditions for the vulnerability are met. Although the EPSS score is not available, the absence of a KEV listing does not diminish the severity. Attackers would need to supply crafted serialized data—likely through plugin configuration pages or API endpoints—and if successful, could execute arbitrary code on the server. No authentication requirement is explicitly stated, but the typical attack vector is through accessible plugin interfaces, so limiting or securing those paths is critical.
