The vulnerability is a PHP Object Injection flaw present in the Flexible Subscriptions plugin versions 1.8.1 and earlier, allowing attackers to inject arbitrary PHP objects into the plugin’s code path. This leads to the potential execution of malicious code on the affected WordPress site, a classic example of CWE-502.

WordPress installations that use the wpdesk Flexible Subscriptions plugin with a version of 1.8.1 or lower are affected. Any site that has not applied the 1.8.2 update remains vulnerable.

The CVSS score of 9.8 reflects a very high severity risk, and the absence of an EPSS rating does not reduce the likelihood of exploitation; attackers could craft malicious serialized data via the plugin’s interfaces. The vulnerability is not listed in CISA’s KEV catalog, but its high CVSS and potential for remote code execution make it a priority for timely remediation. Based on the description, the likely attack vector involves manipulating serialized objects submitted through the plugin’s administration or user functions, which can be exploited remotely if the site is publicly accessible.