An unauthenticated PHP object injection vulnerability in the ChamaWP WordPress plugin creates a critical risk of remote code execution, requiring an immediate update to version 1.0.13 or later.

This vulnerability occurs because the plugin does not properly validate user input before passing it to a PHP deserialization function. An unauthenticated attacker can inject arbitrary PHP objects, which may lead to remote code execution if a suitable gadget chain is available within the environment.

Exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the underlying server, leading to a total compromise of the WordPress installation and potentially the host system. With a CVSS score of 8.1, the high potential for full system control and data exfiltration necessitates urgent patching.

Immediate Action: Update the ChamaWP plugin to version 1.0.13 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Monitor for suspicious POST requests targeting the plugin and audit application logs for unexpected code execution or unusual object instantiation patterns.

Compensating Controls: Use a Web Application Firewall (WAF) to block suspicious payloads that attempt to pass serialized PHP objects to the application.

Public Exploit Available: No (unknown)

Given the critical nature of remote code execution vulnerabilities in plugins, administrators must prioritize this update. Ensure all plugin components are updated to the secure version 1.0.13 or later and conduct a security review of the installation for any signs of prior unauthorized access.