This vulnerability is a PHP Object Injection flaw found in TaxoPress plugin versions up to 3.51.0. When an attacker supplies crafted data through editor functions, the plugin deserializes untrusted input, enabling arbitrary object creation. The result is potential remote code execution or the ability to modify system data. The weakness corresponds to CWE-502—deserialization of untrusted data.

Affected systems are WordPress installations running the TaxoPress plugin by Steve Burge, with version numbers 3.51.0 or earlier. No additional vendor or product variants are listed. The issue is limited to users who have the ability to interact with the plugin's editor interface, such as administrators or authors with plugin editing rights.

The CVSS score of 8.8 indicates high severity, but the EPSS is not available, so uncertainty remains about current exploitation frequency. Since the vulnerability is not in the CISA KEV catalog, there is no known public exploit at this time. Attack vectors likely involve authenticated access, especially to the editor, as the flaw requires legitimate user permissions to craft the malicious input. The potential impact is substantial, freeing attackers to execute code or alter data on the affected WordPress site.