The Tainacan Community Tainacan plugin for WordPress contains a Deserialization of Untrusted Data flaw that permits PHP Object Injection. By supplying crafted serialized data, an attacker can inject arbitrary PHP objects, potentially leading to the execution of attacker‑chosen code on the web server if the plugin or WordPress processes that data. This vulnerability is categorized as CWE‑502 and poses a high confidentiality, integrity, and availability threat to sites using the affected plugin.

WordPress installations that have the Tainacan plugin version 1.3.0 or earlier are impacted. The plugin, identified in the CNA as "Tainacan Community:Tainacan," does not specify a minimum version, so every instance using the legacy plugin binaries is potentially vulnerable until a newer release is applied.

The CVSS score of 7.2 indicates considerable severity, while no EPSS score is published, making the current exploitation likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated or unauthenticated user exploiting the plugin’s deserialization mechanism through crafted input, such as via form data, URL parameters, or other exposed endpoints that accept serialized objects. The absence of a publicly disclosed exploit does not reduce the risk if attackers can directly manipulate serialized payloads.