WordPress plugin Woocommerce Category Banner Management is vulnerable to PHP object injection due to improper deserialization of untrusted data. Attackers can send specially crafted serialized objects that cause the plugin to instantiate arbitrary PHP classes and set properties, potentially leading to code execution or other malicious actions. This flaw is classified as CWE‑502, representing the ability to exploit deserialization with untrusted input.

The vulnerability affects the Dotstore Woocommerce Category Banner Management plugin for WordPress, from the earliest release up to and including version 2.5.1. Any WordPress site that installs this plugin and does not remove or upgrade it after the mentioned date is at risk.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests that exploitation opportunities are currently rare, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack vector is remote, where an attacker sends a malicious payload via HTTP requests that trigger the deserialization logic within the plugin. If exploited, the attacker could gain remote code execution on the affected WordPress site, compromising confidentiality, integrity, and availability.