The Directorist plugin for WordPress suffers from a deserialization of untrusted data flaw that allows attackers to perform PHP object injection. This vulnerability, identified as CWE‑502, can lead to arbitrary code execution on the web server under the permissions of the application. The impact includes full compromise of confidentiality, integrity, and availability of the affected site, potentially affecting all users and the underlying infrastructure.

The issue affects the wpWax Directorist plugin from any earlier version through 8.8.2. All WordPress sites hosting a Directorist installation of these versions are vulnerable unless the plugin is upgraded or disabled.

The CVSS score of 9.8 marks the flaw as critical, and while the EPSS score is <1%, indicating a low current probability of exploitation, the lack of listing in the CISA KEV catalog does not diminish its risk. Attackers would likely craft malicious serialized PHP objects and deliver them via HTTP requests that trigger unserialization within Directorist. Successful exploitation would allow full code execution without additional conditions.