An unauthenticated remote code execution vulnerability in the CraftCMS vCard Plugin 1.0.0 allows attackers to execute arbitrary PHP code via crafted serialized payloads.

This is a deserialization of untrusted data vulnerability (CWE-502) that allows unauthenticated attackers to trigger remote code execution by sending a specially crafted request to the plugin's vCard download endpoint.

A successful exploit grants the attacker the ability to execute arbitrary code on the underlying server, leading to a complete compromise of the CMS and potentially the entire host environment. With a CVSS score of 9.8, this vulnerability poses a critical threat to the confidentiality and integrity of the application.

Immediate Action: Users should immediately uninstall or disable the vCard plugin if it is not business-critical until a verified security patch is released by the developer.

Proactive Monitoring: Inspect web access logs for requests to vCard download endpoints containing serialized PHP objects or suspicious character sequences.

Compensating Controls: Implement WAF rules to inspect and block incoming HTTP requests that contain serialized PHP structures (e.g., 'O:').

Public Exploit Available: Yes — a public exploit is available on ExploitDB and documented on GitLab.

Due to the critical nature of this remote code execution vulnerability and the presence of publicly available exploit code, immediate removal or restriction of the affected plugin is required. Organizations should treat this as a high-priority incident until the component is removed or patched.