The vulnerability is an editor PHP Object Injection in OptionTree plugin 2.7.3 and earlier, allowing malicious payloads to be deserialized in PHP, which can lead to arbitrary code execution. The flaw aligns with CWE-502, where unsafe object unserialization can compromise confidentiality, integrity, and availability by enabling attackers to execute arbitrary code. The potential impact includes full system compromise if an attacker can supply the payload during an editing session.

The affected component is the WordPress OptionTree plugin for all WordPress installations that have a version of OptionTree 2.7.3 or lower. Site administrators should verify their installed plugin version and look for deployments of the plugin in any WordPress site.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of KEV listing does not eliminate the risk. Likely attack vector is via the plugin's editor interface, where an attacker could supply a crafted serialized object. Because PHP Object Injection can lead to arbitrary code execution, the vulnerability is considered high risk if the plugin is exposed to unauthenticated or low-privilege users.