The vulnerability is an unauthenticated PHP Object Injection flaw found in WordPress Forminator plugin versions 1.57.0 and earlier. An attacker can supply a crafted serialized object that the plugin will unserialize without proper validation, leading to arbitrary code execution on the affected WordPress site. This flaw corresponds to CWE-502 and carries a CVSS score of 9.8, indicating a high severity attack that compromises confidentiality, integrity, and availability of the host.

The affected product is the WordPress Forminator plugin, developed by WPMU DEV. Versions 1.57.0 and all earlier releases are vulnerable. Any WordPress installation that has the Forminator plugin installed and has not been upgraded to at least 1.57.1 is at risk.

The CVSS score of 9.8 reflects a critical risk, and while no EPSS score is provided, the absence of a KEV listing does not reduce the likelihood of exploitation. The attack vector is inferred to be a crafted request to a Forminator form endpoint that receives unserialized data. Because the flaw is unauthenticated, an attacker does not need prior access to the site, and remote code execution can be achieved on any affected WordPress instance that can be contacted over the network.