The vulnerability permits a PHP Object Injection flaw that allows an attacker to instantiate arbitrary PHP classes within the DesignSetGo plugin when it is version 2.8.0 or earlier. This flaw can lead to the arbitrary execution of PHP code, resulting in full compromise of the compromised WordPress site and posing a severe threat to confidentiality, integrity, and availability.

The affected product is the WordPress DesignSetGo plugin developed by Justin Nealey. All releases through version 2.8.0 are vulnerable and need to be remediated.

The CVSS score of 8.8 indicates a high severity. No EPSS score is provided, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote; because the plugin processes user input on the web, an attacker could deliver a crafted payload via HTTP to trigger the object injection.