A PHP Object Injection flaw exists in the SEO Squirrly WordPress plugin for versions up to 14.2.5. The vulnerability allows malicious actors to manipulate serialized PHP objects supplied to the plugin, potentially leading to execution of arbitrary code on the affected server. This can compromise site confidentiality, and, if exploited, may provide full control of the web application or underlying server.

SEO Squirrly’s SEO Plugin by Squirrly SEO, versions 14.2.5 or older. Any WordPress installation that has this plugin activated is susceptible unless a newer version is installed.

The CVSS score of 8.8 classifies the vulnerability as high severity. No EPSS score is available, so exploitation likelihood remains uncertain but consideration of an active threat model is warranted. The plugin is not currently listed in the CISA KEV catalog, indicating no widespread exploitation has been observed to date. The attack vector is likely via plugin interaction such as form submissions or administrative functions that accept serialized data, though the exact path is not detailed in the description. The impact of successful exploitation would be equivalent to remote code execution on the host.