Based on the description, it is inferred that the vulnerability is a deserialization of untrusted data flaw that allows PHP Object Injection, enabling an attacker to construct malicious serialized payloads that can be executed on the server. The flaw is categorized as CWE‑502 and may result in the attacker gaining arbitrary code execution or privilege escalation on the affected system. The impact is therefore remote code execution, potentially compromising site integrity and data confidentiality.

The affected product is the Real Testimonials plugin developed by ShapedPlugin LLC, versions up to and including 3.1.15.

With a CVSS score of 7.2 the risk is moderate to high, and the EPSS score of less than 1% indicates a low probability of exploitation under normal circumstances. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to supply crafted serialized data to the plugin’s deserialization routines, typically via plugin interfaces or form submissions exposed by the plugin.