The ConvertPlus WordPress plugin is susceptible to deserialization of untrusted data through the style parameter of the cp_display_preview_modal AJAX endpoint. The flaw originates from a nonce guard that incorrectly activates only when the parameter is present, a missing capability check, and inadequate sanitization that fails to strip shortcode delimiters. Because the style value is concatenated into a shortcode string and subsequently processed by do_shortcode(), an attacker can inject an additional [smile_modal] call that delivers base64‑encoded payloads to maybe_unserialize() without any allowed_classes restriction, enabling PHP object injection for any authenticated user with Subscriber privileges or higher. This attack vector allows an attacker to manipulate serialized objects and, if a vulnerable plugin or theme containing a deserialization or object‑execution chain exists on the same WordPress installation, potentially delete files, exfiltrate data, or execute arbitrary code.

All installations of the ConvertPlus plugin for WordPress with version 3.6.3 or earlier. The vulnerability requires that the site be running WordPress and have the plugin activated; any WordPress site that has ConvertPlus installed in a vulnerable version is at risk.

The CVSS score of 8.8 rates this flaw as high severity. An attacker needs only Subscriber‑level or higher access to exploit it. The EPSS score is not available, so no data on current exploit likelihood can be provided. This vulnerability is not listed in the CISA KEV catalog. Although no proof‑of‑concept chain is present within ConvertPlus itself, the flaw can serve as a foothold for a remote code execution or data exfiltration attack if the target site also runs another plugin or theme that contains a PHP object deserialization or execution chain. In the absence of such a chain, the impact is limited to the scope of the vulnerable plugin alone.