The Subscribe to Download WordPress plugin contains a critical PHP Object Injection vulnerability that allows unauthenticated attackers to execute arbitrary code.

This vulnerability is a Deserialization of Untrusted Data (CWE-502) flaw within the plugin. The vulnerability is exploitable by unauthenticated remote attackers, as indicated by the CVSS vector (AV:N/PR:N/UI:N).

Successful exploitation allows an attacker to perform arbitrary code execution, potentially leading to a full compromise of the WordPress site, data exfiltration, or total system takeover. Although the base CVSS score is 9.8, the nature of remote unauthenticated code execution poses a severe risk to organizational data integrity and availability.

Immediate Action: Update the Subscribe to Download plugin to version 2.1.0 or later immediately.

Proactive Monitoring: Review web server and WordPress application logs for suspicious serialized input strings or unexpected PHP object instantiation patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized objects in HTTP requests.

Public Exploit Available: Unknown

This vulnerability presents a critical threat to the security of your WordPress environment. Administrators must prioritize updating to version 2.1.0 immediately to eliminate the risk of remote code execution.