Technical impact
Based on the description, it is inferred that the WPJAM Basic plugin blindly unserializes user‑supplied data, enabling attackers to inject arbitrary serialized PHP objects. This PHP Object Injection flaw is aligned with CWE‑502, which signifies untrusted data deserialization. The outcome can be remote code execution, file manipulation, or unauthorized database access, effectively granting the attacker the privileges of the WordPress site’s PHP process.
Affected Systems
The vulnerable product is the WordPress WPJAM Basic plugin, version 7.0 and earlier, published by denishua. No specific sub‑versions are named beyond the generic range; thus all installations using a 7.0 or earlier release are affected.
Risk and Exploitability
The CVSS score is 8.8, indicating high severity. The EPSS score is less than 1%, which suggests that, while possible, exploitation in the wild is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the WordPress web interface where the plugin processes user‑supplied requests; an attacker can trigger the flaw via crafted HTTP requests or forms that include malicious serialized data. Successful exploitation would grant the attacker the privileges of the WordPress site’s PHP process, potentially leading to site compromise.
