The Remote API WordPress plugin contains a critical deserialization vulnerability that allows unauthenticated attackers to achieve remote code execution.

This vulnerability involves improper control of code generation (CWE-94) where the plugin fails to authenticate requests before deserializing user-supplied input. An unauthenticated attacker can inject arbitrary PHP objects, which may lead to remote code execution if a compatible gadget chain exists within the WordPress environment.

Successful exploitation of this vulnerability results in a complete compromise of the affected WordPress site, as the attacker can execute arbitrary code with the privileges of the web server. This poses a severe risk of data theft, site defacement, and unauthorized persistence, justifying the critical CVSS score of 9.0.

Immediate Action: As no official patch is currently available, administrators should immediately deactivate and remove the Remote API plugin from all WordPress installations.

Proactive Monitoring: Monitor server access logs for unusual POST requests targeting the plugin endpoints or indicators of suspicious object injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and unauthorized serialized data structures.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the absence of a vendor-supplied patch, immediate removal of the affected plugin is the only effective mitigation. Security teams should prioritize identifying all instances of the Remote API plugin within their infrastructure and ensuring they are disabled until a secure version is released and verified.