A high-severity object injection vulnerability in the Welcart e-Commerce plugin poses a significant risk of unauthorized code execution to affected WordPress environments.

This vulnerability is a deserialization of untrusted data flaw (CWE-502) within the usc-e-shop component, which can be triggered by an authenticated administrator to achieve object injection.

Successful exploitation of this vulnerability permits an attacker to perform object injection, which often results in remote code execution, unauthorized data modification, or service disruption. Given the CVSS score of 7.2, this vulnerability represents a high risk to the confidentiality, integrity, and availability of the e-commerce platform and its underlying server infrastructure.

Immediate Action: Monitor the vendor for the release of a security update and apply the patch immediately upon availability.

Proactive Monitoring: Review administrative access logs for suspicious activity and monitor server process behavior for unauthorized execution patterns or unexpected spikes in resource utilization.

Compensating Controls: Implement a Web Application Firewall with rules configured to detect and block malicious serialized objects in HTTP requests to the target application.

Public Exploit Available: Unknown.

The severity of this flaw warrants an immediate review of the affected infrastructure to identify any instances of the vulnerable plugin version. Security teams must prioritize applying the forthcoming patch and maintain heightened vigilance over administrative account usage until the environment is fully remediated.