The vulnerability is a deserialization of untrusted data in the Podlove Web Player plugin, which allows malicious actors to perform PHP object injection. Object injection can lead to arbitrary PHP code execution on the web server, effectively compromising the integrity and confidentiality of the system. The flaw is classified as CWE‑502: Insecure Deserialization, indicating that user-controllable data is being unserialized without proper validation.

The affected product is the WordPress Podlove Web Player plugin, developed by gerritvanaaken. Any installation with a version up to and including 5.9.1 is vulnerable; the issue is not present in newer releases beyond 5.9.1.

The CVSS score of 7.5 marks this flaw as high severity. EPSS is reported as <1%, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the potential impact is significant. Based on the plugin’s nature, exploitation would likely occur via a web request that includes malicious serialized data, possibly through an authenticated WordPress admin interface or a crafted request to the plugin’s endpoints. If an attacker can inject objects, they can execute arbitrary PHP code on the server.