The vulnerability is a PHP Object Injection flaw in the WordPress YayMail plugin versions up to 4.4.6. By sending a crafted serialized PHP object to the plugin’s input points, an attacker can force PHP to instantiate arbitrary objects. If the plugin or application subsequently uses methods such as __wakeup__ or __destruct__ that trigger code execution, the attacker could gain remote code execution or other elevated privileges on the host. The primary impact is the potential to execute arbitrary code on the server.

The flaw affects the YayMail plugin distributed by YayCommerce. All installations of YayMail plugin version 4.4.6 and earlier are vulnerable. Affected are WordPress sites that have not yet upgraded beyond that version threshold.

The CVSS score of 7.2 classifies this vulnerability as high severity. No EPSS score is available, which does not provide an estimate of exploitation likelihood, but the absence of a KEV listing indicates it has not yet been widely exploited in the wild. The likely attack vector is an unauthenticated or low-privilege HTTP request directed at the plugin’s exposed endpoints, carrying a malicious serialized payload. An attacker with this ability could achieve remote code execution, compromising the confidentiality, integrity, and availability of the affected WordPress site.