The vulnerability is a PHP Object Injection flaw in the Essential Real Estate WordPress plugin up to version 5.3.3. It allows an attacker to craft a serialized string that, when processed by the plugin, triggers the instantiation of arbitrary objects. This leads to remote code execution or other dangerous behaviors over the web, as reflected in the CWE-502 classification.

WordPress sites running the g5theme Essential Real Estate plugin version 5.3.3 or earlier are affected. No other version or product details are provided.

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available, but the lack of KEV listing suggests no actively exploited instances are publicly known at this time. The attack vector is likely remote via crafted HTTP requests that provide a serialized payload to the vulnerable plugin. An attacker would need network access to the site and the ability to upload or simulate input that reaches the insecure unserialize point.