The Super Stage WP WordPress plugin through version 1.0.1 deserializes data received via HTTP requests without validation, allowing an attacker to inject a serialized PHP object. If an attacker can supply a suitable gadget chain in the input, the deserialization process can lead to arbitrary code execution on the host. This flaw matches CWE‑502 and represents a significant security weakness that can compromise the confidentiality, integrity, and availability of the affected website.

The vulnerability exists in the Super Stage WP plugin for WordPress, affecting all installations using version 1.0.1 or earlier. The plugin is listed as 'Unknown:Super Stage WP' in vendor terminology. No additional version specificity is provided beyond the upper bound of 1.0.1, so any deployment of that range of versions is potentially impacted.

With a CVSS score of 6.5 the vulnerability carries a moderate severity, yet the EPSS score is below 1% indicating a low probability of exploitation in the wild at present. The exploit is unauthenticated and relies on any HTTP request containing crafted serialized data; therefore any public endpoint that passes user input through the plugin is a potential attack vector. The lack of a KEV listing further suggests that active exploitation is not widespread, but the presence of an object injection vector still warrants prompt attention.