The TaxoPress plugin for WordPress contains a Deserialization of Untrusted Data flaw that permits PHP Object Injection. By supplying a specially crafted payload that is unserialized by the plugin, an attacker can instantiate arbitrary objects, which can lead to the execution of malicious code or unauthorized changes to site data. The weakness is classified as CWE‑502.

WordPress sites that use TaxoPress plugin version 3.51.0 or earlier are affected. Any installation running TaxoPress through its latest version before 3.52.0 is vulnerable; no other product variants are known.

The CVSS score of 8.8 signals high severity, and the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not catalogued as a Known Exploited Vulnerability by CISA. Attackers would likely need authenticated access to the plugin's editor interface to craft the malicious payload; this inference is based on the requirement that the plugin unserializes user-supplied data. A successful exploitation could allow remote code execution or significant data tampering on the affected WordPress site.