The Nexter Extension plugin for WordPress contains a critical PHP Object Injection vulnerability that allows unauthenticated attackers to execute arbitrary code if a compatible POP chain exists.

This is a deserialization of untrusted data (CWE-502) vulnerability where the nxt_unserialize_replace function processes user-supplied input without proper validation. The flaw permits unauthenticated attackers to inject malicious PHP objects, which can lead to file deletion, data theft, or remote code execution depending on the presence of additional software components on the target environment.

Successful exploitation poses a severe risk to the confidentiality, integrity, and availability of the WordPress site. While the CVSS score of 8.1 reflects a high severity, the actual impact is contingent on the presence of secondary plugins or themes containing Property Oriented Programming (POP) chains; however, the potential for remote code execution warrants immediate remediation to prevent unauthorized system control.

Immediate Action: Update the Nexter Extension – Site Enhancements Toolkit plugin to the latest version immediately to ensure the deserialization flaw is patched.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the nxt_unserialize_replace function or unusual serialized PHP objects in request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block serialized PHP objects in HTTP requests as a temporary defensive measure.

Public Exploit Available: Unknown

Given the potential for remote code execution, administrators should prioritize updating this plugin across all WordPress instances. Verify that all components of the site are updated to their latest secure versions and perform a security audit to ensure no other vulnerable plugins are present that could facilitate a POP chain attack.