The vulnerability is a PHP Object Injection flaw (CWE-502) in the Fusion Builder WordPress plugin. Attackers can construct malicious serialized PHP objects that, when processed by the plugin, may trigger arbitrary code execution or other destructive behavior, compromising the confidentiality, integrity, and availability of the affected site.

ThemeFusion Fusion Builder plugin versions up to and including 3.15.4 are affected. All WordPress sites that have this version of the plugin installed are at risk until they upgrade.

The CVSS score of 9.8 reflects high severity and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, with an attacker able to supply the crafted payload via the plugin’s input handling (e.g., form submissions or API calls).