The Metagauss EventPrime plugin handles serialized data without proper validation, enabling PHP object injection. This weakness allows an attacker to craft objects that, when instantiated by the plugin, can overwrite internal properties or execute arbitrary code, thereby compromising the WordPress site’s integrity, confidentiality and availability.

WordPress sites that have the EventPrime event-calendar-management plugin installed at any version from the initial release up to and including 4.2.8.0 are affected. The vulnerability applies to all installations of the plugin regardless of deployment size.

The vulnerability is assigned a CVSS score of 9.8, indicating severe impact. The EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, suggesting that exploitation is not common yet. The likely attack vector is the injection of crafted serialized data through any interface where the plugin accepts external input, such as plugin configuration forms or data import functions. The attacker needs to supply malicious payload data; once accepted, the plugin will instantiate objects that can perform arbitrary operations on the system. Due to the high severity and the potential for remote code execution, the risk remains significant despite low observed exploitation probability.