A critical object injection vulnerability in the NooTheme Visionary Core plugin allows authenticated attackers to potentially achieve remote code execution.

This vulnerability involves the insecure deserialization of untrusted data, specifically identified as CWE-502. The flaw allows an authenticated user to perform PHP object injection via the noo-visionary-core component.

The exploitation of this vulnerability could lead to a complete compromise of the affected WordPress site. Given the CVSS score of 8.8, this flaw represents a significant risk, as it allows attackers to potentially execute arbitrary code, manipulate system data, or cause a denial of service, which would result in severe reputational damage and operational downtime.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate or remove the Visionary Core plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious serialized data patterns or unusual POST requests directed at the plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization attempts or PHP object injection payloads.

Public Exploit Available: Unknown.

The severity of this deserialization flaw necessitates immediate action to prevent unauthorized system access. Administrators must prioritize the deactivation of the vulnerable plugin and continuously monitor vendor channels for the release of a security update. Maintaining a strong defensive posture through WAF rules will provide temporary protection until a permanent fix is verified and applied.