The vulnerability is a deserialization flaw that permits untrusted data to be processed as PHP objects, enabling object injection. An attacker can inject crafted serialized payloads into the Nexa Blocks plugin, potentially executing arbitrary code within the WordPress site and compromising confidentiality, integrity, and availability. The CVSS score of 9.8 reflects the high severity and the full compromise risk.

The affected product is the Nexa Blocks plugin for WordPress, supplied by wpdive. All releases up to and including version 1.1.1 are vulnerable. No additional version details are listed in the advisory.

The EPSS score indicates the exploit probability is low (<1%), but the vulnerability remains highly dangerous. It is not currently listed in the CISA KEV catalog, suggesting no known public exploitation yet. The likely attack vector involves an attacker sending a maliciously crafted HTTP request containing a serialized object payload to the plugin’s endpoints, which the plugin processes without sufficient validation. The vulnerability’s impact allows an attacker to gain full control over the affected WordPress site.