Contributor PHP Object Injection occurs in the WordPress RTMKit plugin through version 2.1.5. The flaw allows an attacker to embed a PHP object within serialized data that the plugin will unserialize during normal operation. If an attacker can supply crafted serialized payloads, the deserialization process can result in arbitrary PHP code execution on the host, compromising confidentiality, integrity, and availability of the entire WordPress site.

The vulnerability affects the WordPress RTMKit plugin developed by RomeTheme. All releases up to and including version 2.1.5 are susceptible. Updating the plugin to version 2.1.6 or later removes the vulnerable code path and eliminates the deserialization entry point.

The CVSS score of 8.8 indicates a high severity, and the EPSS score is not available, so there is insufficient data to gauge current exploitation frequency. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers would need to supply crafted serialized data that the plugin will unserialize, potentially through web form or REST endpoints. Successful exploitation would allow execution of arbitrary PHP code on the server.