The vulnerability is a deserialization of untrusted data flaw that permits PHP object injection. An attacker can supply crafted serialized payloads that are parsed by the Secudeal Payments for Ecommerce plugin, allowing arbitrary PHP objects to be instantiated. This can lead to remote code execution if the injected objects trigger destructive or malicious behavior. The impact is therefore the potential loss of control over the affected server, modification of site files, and exposure of sensitive data.

The plugin is distributed by maximsecudeal under the name Secudeal Payments for Ecommerce. All installations running version 1.1 or earlier are affected. This includes WordPress sites that have the plugin installed with any version equal to or less than 1.1.

The CVSS score of 8.6 indicates a high severity class. The EPSS of less than 1% shows the likely immediate likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker would need to inject serialized input through a plugin‑provided interface or the WordPress admin area. While no proof‑of‑concept or public exploit is available, the mechanism gives an attacker the ability to execute arbitrary code if the platform permits.