The vulnerability is a Deserialization of Untrusted Data flaw that permits Object Injection in the blubrry PowerPress Podcasting WordPress plugin. By manipulating serialized input data, an attacker could create arbitrary objects that may execute code on the server during deserialization, potentially compromising confidentiality, integrity, and availability of the affected website.

All installations of the PowerPress Podcasting plugin with versions up to and including 11.15.10 are affected. Users with any earlier or unspecified versions should verify their installation and upgrade if necessary.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is reported as less than 1%, showing low but nonzero exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw can be exploited through crafted HTTP requests that deliver malicious serialized data to the plugin’s deserialization endpoint, suggesting a remote, web-based exploitation path.