Unauthenticated PHP Object Injection in the Zoho Flow WordPress plugin versions 2.14.5 and earlier enables an attacker to instantiate arbitrary PHP objects. The injection flaw corresponds to the classic Remote Code Execution weakness. If exploited, an attacker can execute arbitrary server‑side code, potentially compromising the entire WordPress site, accessing confidential data, installing malware, and defacing the website.

The vulnerability affects the Zoho Flow plugin for WordPress, specifically all releases up to and including version 2.14.5. The product is distributed by Zoho Flow.

The flaw carries a CVSS score of 9.8, indicating a critical severity. Although the EPSS score is not available, the lack of any known exploits listed in the CISA KEV catalog does not diminish the risk, because the vulnerability is unauthenticated and can be triggered by any external user. The likely attack path involves submitting a crafted request to the plugin’s endpoint, leading to object instantiation and execution of attacker‑controlled code.