The Captivate Sync WordPress plugin is affected by a critical PHP Object Injection vulnerability that enables unauthorized remote code execution.

The plugin suffers from a Deserialization of Untrusted Data flaw (CWE-502). The vulnerability is accessible to unauthenticated attackers over the network, making it a high-priority target for automated exploitation.

An attacker successfully exploiting this flaw can gain full control over the application, leading to unauthorized access to sensitive information or complete site takeover. The high CVSS score reflects the ease of exploitation and the severe impact on system confidentiality, integrity, and availability.

Immediate Action: Update the Captivate Sync plugin to version 3.2.2 or later.

Proactive Monitoring: Monitor site traffic for unusual POST requests containing serialized PHP objects, which may indicate an attempt to exploit this vulnerability.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests and block known malicious patterns associated with PHP object injection.

Public Exploit Available: Unknown

Immediate remediation is required to protect the integrity of the affected WordPress site. Ensure the plugin is updated to version 3.2.2 immediately to mitigate the risk of remote code execution.