The vulnerability is deserialization of untrusted data in the Themify Popup plugin, allowing object injection. This is classified as CWE-502 – insecure deserialization. This could enable an attacker to instantiate malicious objects or alter object state, potentially resulting in arbitrary code execution on the host server or other forms of site compromise.

The issue affects the Themify Popup WordPress plugin on all versions up through 1.4.3. Any WordPress site that has installed this plugin and is running a vulnerable version is potentially impacted, regardless of the underlying WordPress core version.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% suggests that the likelihood of the vulnerability being exploited in the wild is low, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is by supplying malicious serialized data to exposed plugin endpoints or configuration interfaces, allowing an attacker to de‑serialize untrusted input and trigger arbitrary code execution.