The vulnerability is insecure deserialization of untrusted data within the Themify Popup WordPress plugin, classified as CWE-502. An attacker can craft malicious serialized data that, when processed by the plugin, causes PHP's object deserialization to instantiate attacker-controlled code or alter the program state, enabling arbitrary code execution on the web server and complete site compromise.

Any WordPress site running the Themify Popup plugin version 1.4.3 or earlier is vulnerable. Installing or updating the plugin to a version prior to 1.4.4 exposes the site to this risk regardless of the WordPress core version.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% suggests the likelihood of exploitation in the wild is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves supplying malicious serialized payloads to the plugin’s exposed interfaces or configuration endpoints, allowing an attacker to trigger PHP's unserialize and execute arbitrary code.