The Remote API WordPress plugin vulnerability allows unauthenticated attackers to supply crafted input to the deserialization routine without any prior authentication. An attacker can inject arbitrary PHP objects, leading to remote code execution when a suitable gadget chain is present through another installed version of the Remote API plugin. This flaw is an instance of PHP Object Injection, mapped to CWE-94.

All releases of the Remote API plugin for WordPress through version 0.2 are affected. The vulnerability is present wherever the ``remote-api`` query parameter is accessible and the plugin is older than 0.2.

The CVSS score of 9.0 indicates a high severity RCE risk, while the EPSS score of less than 1% shows a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. An attacker can reach the vulnerable endpoint over the network and, without authentication, supply a malicious object payload. Whether the attack succeeds depends on the existence of a compatible gadget chain in another installed instance of the Remote API plugin. The likely attack vector is remote, unauthenticated HTTP requests targeting the ``remote-api`` endpoint.