Unauthenticated PHP Object Injection exists in the Easy Google Maps plugin versions up to and including 1.13.0. The flaw allows an attacker to craft a specially crafted HTTP request that is deserialized by the plugin’s PHP code, enabling the attacker to instantiate arbitrary objects and potentially execute arbitrary code on the host server. This results in complete compromise of the affected web application, allowing disclosure, modification, or deletion of data and execution of commands on the underlying system.

The vulnerability affects the Easy Google Maps plugin developed by Supsystic, specifically all releases with version numbers 1.13.0 or earlier. WordPress sites that have not upgraded beyond 1.13.0 are susceptible, regardless of other plugins or themes. No additional systems or extensions are listed as affected.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. No details on required conditions are provided, so the likely attack vector is inferred to be unauthenticated HTTP requests targeting the plugin’s endpoints, with no authentication or privilege escalation needed. Given the high severity, the risk of exploitation is substantial for sites that have not applied the available patch.