A critical object injection vulnerability in the Arraytics Eventin plugin allows authenticated users to achieve remote code execution, posing a significant risk to WordPress site integrity.

The plugin fails to properly sanitize input during deserialization, which allows an authenticated attacker with low privileges to inject arbitrary PHP objects. This flaw resides within the wp-event-solution component of the plugin.

Successful exploitation of this vulnerability can lead to full site compromise, as object injection frequently serves as a vector for remote code execution. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational data confidentiality, integrity, and availability. Compromise of the WordPress environment can facilitate further lateral movement within the network or the theft of sensitive user information.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and uninstall the Eventin plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the plugin directory or unusual serialized PHP strings.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common object injection payloads and monitor for unauthorized administrative actions.

Public Exploit Available: Yes, a technical write-up detailing the vulnerability has been published by Patchstack.

Given the severity of object injection vulnerabilities, organizations must prioritize the removal or mitigation of the Eventin plugin. Administrators should maintain a high state of vigilance and monitor the vendor's advisory channels for the release of a patched version. Applying the eventual update as soon as it becomes available is the only definitive way to resolve this security defect.