This vulnerability arises from deserialization of untrusted data within the WooCommerce Infinite Scroll plugin. An attacker can inject a crafted serialized object that will be unserialized by the plugin, enabling arbitrary code execution on the host system. The resulting impact includes full compromise of the WordPress installation, allowing attackers to read, modify, or delete data, and possibly launch further attacks against the underlying web server.

Affecting WordPress sites that run sbthemes' WooCommerce Infinite Scroll plugin version 1.6.2 or earlier. The issue exists from the earliest release through 1.6.2, so any site that has not upgraded beyond this version remains vulnerable.

The CVSS base score of 8.8 classifies the flaw as high severity, indicating a remote impact. EPSS estimates less than 1% chance of exploitation in the wild, and the flaw is not listed in CISA's KEV catalog. Likely attack vector is remote through HTTP requests targeting the plugin’s endpoints; however, the exact method is not detailed in the provided description, so this is inferred. The combination of high impact and low exploitation probability suggests that while the vulnerability is serious, the likelihood of finding an attacker with the specific knowledge to exploit it remains modest.