The Content Egg plugin for WordPress, versions 6.3.1 and earlier, contains a PHP Object Injection flaw (CWE-502). The vulnerability allows an attacker to submit malicious serialized data that is deserialized by the plugin, enabling arbitrary PHP code execution and full compromise of the site. This weakness turns the plugin into a potential code‑execution vector for attackers targeting the WordPress installation.

WordPress sites that have installed the Content Egg plugin from keywordrush, version 6.3.1 or older. Any instance of the plugin that has not been updated to a later release is susceptible.

The CVSS score of 7.2 indicates a high severity for potential exploitation. No EPSS score is available, so the current exploitation probability is unknown, and the issue is not listed in CISA KEV. The likely attack vector is web‑based, with an attacker crafting a serialized payload delivered via a URL or form that the plugin processes. If successfully exploited, the attacker could achieve full system compromise through code execution.