An attacker can supply malicious serialized data to the WpEvently plugin, which is deserialized without proper validation. This object injection flaw can allow the attacker to execute arbitrary code, compromising the confidentiality, integrity, and availability of the affected WordPress site.

The vulnerability affects the magepeopleteam WpEvently plugin from the earliest version through 5.0.8, so any site running WpEvently version 5.0.8 or earlier is at risk.

The CVSS score of 8.8 indicates a high severity vulnerability, and the EPSS probability is currently below 1%, suggesting that exploitation is not widely observed. Based on the description, it is inferred that the attack vector may involve either unauthenticated access through publicly exposed endpoints or authenticated exploitation via an administrator account. The vulnerability is not listed in the CISA KEV catalog, but due to the potential for remote code execution, immediate remediation is advised.