The vulnerability is an unauthenticated PHP Object Injection in versions of the FundEngine plugin up to 1.7.9. This flaw allows an attacker to supply malicious serialized data that, when deserialized by the plugin, can cause remote code execution and compromise the integrity and confidentiality of the affected WordPress site. Based on the description, it is inferred that an attacker could gain full control over the application without authentication.

Roxnor’s FundEngine plugin for WordPress, versions 1.7.9 and earlier. Any WordPress site that has installed one of these affected plugin releases is vulnerable.

The CVSS score of 9.8 indicates a critical severity, and the vulnerability is unauthenticated, meaning that the attacker requires only publicly reachable access to the site. Though no EPSS score is available, the lack of a KEV listing does not reduce exploitation risk; the public distribution of the plugin and the ability to craft serialized payloads make exploitation relatively low effort. The likely attack vector is via the web interface that accepts serialized input, and exploitation can occur from any network location that can reach the vulnerable WordPress instance.