The vulnerability is an unauthenticated PHP Object Injection that occurs in Ultimate Maps by Supsystic versions prior to 1.5.0. It allows an attacker to inject malicious objects that are unserialized by the application, potentially resulting in arbitrary code execution. The weakness falls under CWE-502, a classic insecure deserialization flaw.

Supsystic’s Ultimate Maps by Supsystic plugin for WordPress is affected. All installations running any version of the plugin older than 1.5.0 are vulnerable. The plugin is deployed on WordPress sites that rely on this mapping functionality.

The CVSS score of 9.8 indicates a very high severity of the flaw. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because the injection is unauthenticated, an attacker can send a crafted request to an endpoint that triggers the deserialization process. The likely attack vector is a web request that transmits a malicious payload to the WordPress site, which the plugin will unserialize without proper validation. If exploited, the attacker can execute any PHP code, compromising the entire WordPress installation.