The Advanced AJAX Product Filters plugin contains a PHP Object Injection flaw in its Live Composer compatibility layer. The deserialization routine accepts untrusted data from the shortcode_check function, allowing an attacker with Author or higher privileges to inject a crafted PHP object. Although the plugin itself has no known vulnerable object payloads, once combined with another plugin or theme that supplies a vulnerable object (a POP chain), the attacker could delete files, read sensitive data, or execute arbitrary code. Therefore the flaw is meaningful only in environments that also host a POP-capable plugin or theme.

WordPress sites running Advanced AJAX Product Filters version 3.1.9.6 or older and with the Live Composer plugin installed. The attacker must also possess Author-level or higher permissions on the WordPress site. No specific WordPress core versions are affected by the code change.

The vulnerability scores a CVSS of 8.8, indicating high severity, but its EPSS is less than 1%, suggesting exploitation is unlikely at present. It is not listed in the CISA KEV catalog. The attack vector requires authenticated access at Author level, so a site with many such users expands the risk surface. The risk to confidentiality, integrity, and availability becomes significant only when a POP chain resides on the same installation. Without such a chain, the flaw alone does not allow code execution or privilege escalation.