A high-severity PHP object injection vulnerability in the WP Store Locator plugin poses a significant risk to WordPress installations by potentially allowing authenticated attackers to execute arbitrary code.

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. It allows a logged-in user with sufficient privileges to inject malicious serialized objects, which can lead to remote code execution or other unauthorized actions.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to gain full control over the WordPress environment, leading to data breaches, site defacement, or the deployment of malicious payloads that could compromise the entire server infrastructure.

Immediate Action: Since a specific patched version is not explicitly confirmed in the provided data, users should immediately check for updates within the WordPress dashboard and apply any available security patches provided by Tijmen Smit. If no update is available, consider disabling the plugin until a secure version is released.

Proactive Monitoring: Security teams should monitor server access logs for anomalous POST requests or serialized data strings targeting the WP Store Locator plugin endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP objects to provide virtual patching capabilities until the software is updated.

Public Exploit Available: Unknown.

Given the high CVSS score and the critical nature of PHP object injection flaws, administrators must treat this vulnerability with urgency. We recommend verifying the current version of the WP Store Locator plugin and applying the latest security updates provided by the vendor as soon as they become available to mitigate the risk of remote code execution.