The WordPress Organici Library plugin contains a deserialization flaw that permits untrusted data to be processed as PHP objects. This deficiency, identified as CWE‑502, allows attackers to inject malicious objects that, when instantiated, can execute arbitrary code on the server. Successful exploitation results in full control of the WordPress installation and potentially the underlying hosting environment.

All WordPress sites that have the NooTheme Organici Library plugin installed at version 2.1.2 or earlier are affected. The issue is triggered whenever the plugin processes serialized data through any of its public interfaces, such as AJAX or REST endpoints, when the plugin is active.

The CVSS score of 8.8 reflects a high severity that could lead to complete loss of system control. The EPSS score of less than 1 % indicates that exploitation is currently uncommon, yet the potential damage remains severe. The vulnerability is not listed in the CISA KEV catalog, reducing its visibility but not its danger. Based on the description, the likely attack vector is the unauthenticated delivery of a crafted serialized payload to a publicly accessible plugin endpoint, which triggers PHP object injection and remote code execution.