A critical PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress allows authenticated attackers to execute arbitrary code.

This is a deserialization of untrusted data vulnerability (CWE-502) that allows an attacker with low-level privileges to inject malicious PHP objects. This can lead to remote code execution or other unauthorized actions within the WordPress environment.

A successful exploit of this vulnerability could lead to a full compromise of the WordPress site, including data theft, unauthorized modification of content, or complete system takeover. Given the CVSS score of 8.8, this vulnerability represents a severe threat to the confidentiality, integrity, and availability of the host application.

Immediate Action: Update the Fluent Forms Pro Add On Pack plugin to version 6.2.7 or later.

Proactive Monitoring: Inspect server logs for unusual PHP execution patterns or attempts to manipulate serialized objects within plugin parameters.

Compensating Controls: Ensure that the WordPress environment is running with the principle of least privilege, and use a Web Application Firewall to block common deserialization attack payloads.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for remote code execution, this vulnerability is critical. Administrators must update the Fluent Forms Pro Add On Pack plugin to version 6.2.7 immediately to eliminate the deserialization flaw and secure the WordPress installation.