The Reycob Product Import Export plugin, versions up to 2.3.0, contains a PHP Object Injection flaw that permits untrusted data to be deserialized during the plugin’s import and export processes. This weakness is marked as CWE-502, indicating insecure deserialization. While the CVE description does not state that remote code execution is guaranteed, the capability to instantiate arbitrary PHP objects can lead to unintended behavior when malicious payloads are processed.

WordPress installations that have Victor Rodriguez’s Reycob Product Import Export plugin installed at version 2.3.0 or earlier are affected. Any site that exposes the plugin’s import interface to users with upload or POST permissions could potentially allow a crafted payload to reach the vulnerable deserialization path.

The vulnerability is assigned a CVSS score of 7.2, indicating high severity. No EPSS score is available, so the probability of exploitation is undetermined but cannot be dismissed. The issue is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation yet. The likely attack vector is sending a serialized payload via the import interface, which could enable an attacker to influence plugin behavior or compromise the site if the deserialization mechanism is abused.