Deserialization of untrusted data in the CartFlows plugin enables PHP Object Injection, a weakness defined as CWE-502. Attackers can craft serialized payloads that the plugin processes without adequate validation, potentially allowing the execution of arbitrary PHP code. This can compromise the entire WordPress instance, exposing sensitive data, enabling further lateral movement, or forming a foothold for persistent malware.

CartFlows, a WordPress plugin authored by Brainstorm Force, is affected in all versions up to and including 2.1.19. Every installation of the plugin between its first release and 2.1.19 is vulnerable when the plugin is active on a WordPress site.

The vulnerability carries a CVSS base score of 7.2, indicating high severity. The EPSS score of less than 1% suggests a low current exploitation probability, yet the privileged impact if exploited remains significant. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits are documented at this time. The likely attack vector involves a remote attacker submitting serialized data to a plugin endpoint that triggers the vulnerable unserialize routine; this inference stems from the nature of PHP Object Injection and the description but is not explicitly confirmed in the advisory.