A critical object injection vulnerability in the PickPlugins Post Grid and Gutenberg Blocks plugin poses a severe risk of unauthorized code execution and system compromise for affected WordPress installations.

This vulnerability involves the insecure deserialization of untrusted data, which can lead to PHP object injection. The vulnerability is exploitable by any authenticated user with sufficient privileges to interact with the plugin functions.

Successful exploitation allows an attacker to execute arbitrary code on the underlying server, potentially leading to full system compromise. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could result in data exfiltration, unauthorized administrative access, and persistent backdoors within the web environment.

Immediate Action: Administrators should immediately disable or remove the PickPlugins Post Grid and Gutenberg Blocks plugin until a security patch is released by the vendor.

Proactive Monitoring: Security teams should monitor server access logs for unusual POST requests targeting plugin endpoints and examine application error logs for deserialization-related exceptions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP objects in HTTP request parameters.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of object injection, this vulnerability must be treated with high priority. Organizations using the affected plugin should restrict access to administrative functions or disable the plugin entirely until the vendor provides a verified security update to remediate the deserialization flaw.