An unauthenticated PHP Object Injection flaw exists in OttoKit plugin versions 1.1.27 and earlier. The vulnerability allows a malicious actor to supply crafted serialized data that is deserialized by the plugin, leading to execution of arbitrary PHP code. The weakness is a classic insecure deserialization problem (CWE-502). If exploited, an attacker can gain complete control over the WordPress site, steal data, deface content or use the site for further attacks.

The affected product is the Brainstorm Force OttoKit WordPress plugin, version 1.1.27 and lower. WordPress sites running these versions are at risk; all other unrelated plugins or WordPress core are not affected.

The CVSS score of 9.8 indicates a severe risk, while the EPSS score of less than 1% suggests that exploitation is currently unlikely or has a very low probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and unauthenticated, requiring the attacker to transmit a malicious payload to the plugin’s processing endpoint. Reaching exploitable input does not appear to require elevated privileges, which amplifies the potential impact.