The Boost plugin for WordPress allows unauthenticated PHP Object Injection via deserialization of the STYXKEY-BOOST_USER_LOCATION cookie. This flaw maps to CWE‑502, permitting an attacker to create an arbitrary PHP object that will be unserialized by the plugin. The vulnerability alone does not provide a functional path for exploitation because the plugin does not contain a vulnerable PHP object popping chain, so there is no direct impact unless a second plugin or theme offers a POP chain.

WordPress sites that have the Boost plugin from PixelYourSite with a version of 2.0.3 or earlier are affected. The flaw is triggered by a client-provided cookie, so any domain serving the plugin at an outdated version is potentially exposed.

The CVSS score of 9.8 indicates a critical severity, though the EPSS score is not reported. The vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated and web-based; an attacker can send a crafted cookie to any visitor of the vulnerable site. If the site also has a POP chain plugin or theme, the attacker could delete files, retrieve sensitive data, or execute arbitrary code. In environments without such a POP chain, the risk is lower, but the high score and potential for compounded exploitation still warrant immediate attention.