The vulnerability is a PHP Object Injection flaw in versions of the Go Live Update Urls plugin up to 7.0.8. It allows an attacker to supply crafted serialized PHP objects that are deserialized by the plugin, potentially leading to arbitrary code execution. This weakness is classified as CWE‑502, a deserialization vulnerability that can compromise both confidentiality and integrity of the affected WordPress installation.

The flaw affects WordPress sites that have installed the Go Live Update Urls plugin from vendor Mat Lipe in versions 7.0.8 or earlier. Any website using those plugin versions is potentially vulnerable and should be evaluated for presence of the plugin.

The vulnerability carries a high CVSS score of 8.8, indicating severe risk. No EPSS score is published, and the issue is not listed in CISA’s KEV catalog, but the severity suggests active exploitation is possible. It is inferred that the attack vector requires an attacker to create a request containing a malicious serialized object; a successful exploitation would give the attacker remote code execution on the affected WordPress instance.