Deserialization of untrusted data in the NooTheme Visionary Core plugin enables object injection, allowing an attacker to create a malicious payload that is processed by the plugin’s deserialization routine. This can trigger execution of arbitrary PHP code, leading to full compromise of the WordPress site’s confidentiality, integrity, and availability.

All installations of the WordPress Visionary Core plugin from NooTheme that are version 1.4.9 or earlier are affected. Any site that has not yet upgraded beyond version 1.4.9 remains at risk.

The CVSS score of 8.8 indicates high severity, while an EPSS score below 1% suggests a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog, but the combination of a high severity score and the ability to inject object payloads via web requests makes remote exploitation feasible. Attackers can craft requests containing malicious serialized objects and send them to the plugin’s input handlers, potentially gaining full control over the server if the site accepts such input without proper filtering.