The vulnerability is a Deserialization of Untrusted Data flaw in the WishList Member X plugin for WordPress, affecting all releases up to and including 3.29.0. This flaw permits a malicious actor to inject PHP objects during deserialization, which can lead to arbitrary code execution, privilege escalation, or unauthorized data access when the plugin processes supplied data. The weakness is classified as CWE-502.

Any WordPress site that has the WishList Member X plugin installed in a version from the initial release up to and including 3.29.0 is vulnerable. No specific sub‑version range is listed beyond the upper bound of 3.29.0.

The CVSS score of 8.8 indicates high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. It is inferred that the attack vector is remote, leveraging the plugin’s handling of serialized data—likely via HTTP requests that deliver unchecked payloads. Exploitation would require the attacker to supply crafted serialized input to the plugin, which will be processed without proper validation.