The "Custom role" feature of the WordPress WP ERP plugin contains a PHP Object Injection flaw in all releases up to version 1.17.9. An attacker who can manipulate the object serialization mechanism can inject a crafted PHP object, which the plugin will unserialize and use without proper validation. This flaw permits the attacker to execute arbitrary PHP code on the WordPress host, giving the attacker full control over the system.

the weDevs WordPress WP ERP plugin, all versions up to and including 1.17.9, deployed on WordPress sites.

The vulnerability has a CVSS score of 7.2, indicating a high severity level. The EPSS score is not available, and it is not listed in the CISA KEV catalog. While no public exploit code is listed, the nature of PHP Object Injection and the lack of validation in the plugin means that exploitation would be possible from a client with access to the Custom Role interface or by sending a crafted request to the site. Attackers with local or authenticated access to the WordPress admin interface stand a higher chance of exploitation, but even unauthenticated users could trick the application if they can directly target the plugin endpoint.