The flaw is a deserialization of untrusted data that permits object injection, allowing an attacker to build a malicious payload that is processed by the plugin and results in arbitrary code execution on a WordPress site. This falls under CWE‑502 and can give an attacker full control of the website, enabling content manipulation, malware installation, or data exfiltration.

The vulnerability affects the JS Archive List plugin for WordPress, developed by Miguel Useche – jquery-archive-list-widget. All versions up to and including 6.1.7 are vulnerable, so any WordPress site running those releases is at risk.

With a CVSS score of 8.8 the flaw is rated high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is via web traffic that delivers serialized input to the plugin, such as an admin impersonation or a crafted request to a plugin endpoint. Successful exploitation would provide remote code execution, making the vulnerability particularly dangerous for exposed WordPress sites that have not upgraded.