A PHP Object Injection vulnerability has been identified in the Kadence WooCommerce Email Designer plugin for WordPress. The flaw allows a shop manager to supply malicious data that is deserialized by the plugin, potentially enabling arbitrary code execution on the host server. The underlying weakness corresponds to CWE-502, indicating that unsafe deserialization of untrusted data can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected WordPress installation.

The vulnerability is present in installations of the Kadence WooCommerce Email Designer plugin from the Nexcess product line that are version 1.5.19.1 or earlier. Users deploying these versions are at risk.

The CVSS score of 7.2 indicates a moderate to high severity, and while an EPSS score is currently unavailable, the absence of mitigation suggests some probability of exploitation. The flaw is not listed in CISA’s KEV catalog, but the nature of PHP object injection is widely known to be exploitable by attackers who can control input. The likely attack vector is through the shop manager interface of WordPress, where crafted input could trigger the vulnerable deserialization path.