The NooTheme Organici Library plugin is vulnerable to PHP object injection, which could allow an authenticated attacker to achieve remote code execution.

This vulnerability involves the insecure deserialization of untrusted data (CWE-502) within the noo-organici-library. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that a low-privileged authenticated attacker can trigger this flaw over the network to compromise the confidentiality, integrity, and availability of the host.

The ability to perform arbitrary PHP object injection poses a severe risk to the entire WordPress environment, as it often leads to remote code execution. With a CVSS score of 8.8, this high-severity vulnerability could result in full site takeover, data exfiltration, or the deployment of malicious payloads within the server infrastructure.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official NooTheme repository or the Patchstack database for updates and apply them as soon as they become available.

Proactive Monitoring: Security teams should review server access logs for anomalous POST requests containing serialized PHP objects or unexpected input patterns directed at the plugin.

Compensating Controls: Deploy or update Web Application Firewall rules to block unauthorized or malicious serialized data payloads targeting the plugin endpoints.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of object injection vulnerabilities, this issue should be treated as a priority. If a patch is not immediately available, administrators should consider deactivating the Organici Library plugin until a secure version is released to prevent potential exploitation.