Deserialization of untrusted data in the Applay - Shortcodes plugin enables PHP object injection. The flaw permits an attacker to craft arbitrary serialized objects that are processed by the plugin, potentially leading to code execution or unauthorized manipulation of the WordPress site. While the impact on confidentiality, integrity, and availability is largely determined by the attacker’s payload, the high severity rating suggests a capability for remote code execution and other critical damage.

The vulnerability affects the WordPress plugin Applay - Shortcodes distributed by leafcolor, specifically all releases through version 3.7. Systems running this plugin on any WordPress installation are potentially exposed. No specific operating system or database version restrictions are listed.

The CVSS score of 9.8 indicates a high risk. The EPSS score of less than 1% implies that, at present, exploitation attempts are rare, but the lack of a KEV listing does not eliminate the possibility of future exploitation. Based on the description, the likely attack surface is a remote attacker submitting malicious serialized data to the plugin, which is then deserialized within the application context. Triggering the vulnerability would require the attacker to deliver the crafted payload through a user-facing interface that does not properly sanitize input.