This vulnerability arises from deserialization of untrusted data within the WpEvently plugin, allowing an attacker to perform PHP Object Injection. The flaw is classified as CWE-502, leading to potential arbitrary code execution when the plugin processes maliciously crafted input. If exploited, an attacker could take full control of the affected WordPress site, compromising confidentiality, integrity, and availability.

WordPress sites running the WpEvently plugin by magepeopleteam on versions up to and including 5.1.1 are impacted. The vulnerability exists from the initial release of the plugin through 5.1.1, affecting any installation that has not applied a subsequent patch.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests the likelihood of immediate exploitation is currently low and the vulnerability is not in the CISA KEV catalog. However, given its remote code execution nature, successful exploitation would allow an attacker to execute arbitrary code on the server. The likely attack vector is a remote actor sending a specially crafted request to a plugin endpoint that triggers unsafe unserialization. Attackers may need to target authenticated sessions or exploit public-facing forms that the plugin processes.