The vulnerability is a Deserialization of Untrusted Data flaw in the WishList Member X WordPress plugin, affecting all releases up to 3.29.0. It enables a malicious actor to inject PHP objects during deserialization, which can lead to arbitrary code execution, privilege escalation, or unauthorized data access when the plugin processes supplied data. The weakness is classified as CWE‑502.

Any WordPress site that has the WishList Member X plugin installed in a version from the initial release up to and including 3.29.0 is vulnerable. No specific sub‑version range is listed beyond the upper bound of 3.29.0.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% shows a very low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector is remote, leveraging the plugin’s handling of serialized data—likely via HTTP requests that deliver unchecked payloads. Exploitation would require the attacker to supply crafted serialized input to the plugin, which will be processed without proper validation.