The vulnerability is a deserialization of untrusted data that permits PHP object injection within the WordPress Advanced Post Manager plugin. This flaw can allow an attacker to instantiate arbitrary PHP objects, potentially executing arbitrary code with the privileges of the web server. The impact is severe, enabling full compromise of the targeted WordPress site, including data theft, defacement, or further pivoting into the underlying infrastructure.

Affected systems include the Liquid Web / StellarWP Advanced Post Manager plugin for WordPress. Versions from the initial release through and including 4.5.5 are vulnerable. Any site running these versions of the plugin is at risk.

The CVSS score is 9.8, indicating an extremely high severity. No EPSS data are available, so the current exploitation probability is unclear, but the lack of a KEV listing suggests no known widespread exploitation yet. Based on the plugin’s web‑fronted nature, the likely attack vector is remote, via crafted HTTP requests delivering malicious serialized payloads to the plugin’s processing code.