A critical object injection vulnerability in the Membership Software WishList Member X plugin, requiring authenticated access, presents a high risk of system compromise.

The plugin is susceptible to CWE-502: Deserialization of Untrusted Data, which allows an authenticated attacker to inject malicious PHP objects. Based on the CVSS vector (PR:L), this attack requires the attacker to hold at least low-level privileges within the WordPress environment.

Successful exploitation of this vulnerability can lead to unauthorized code execution, potentially resulting in full system compromise, data theft, or complete loss of service. With a CVSS score of 8.8, this flaw is categorized as High severity, indicating that the impact on confidentiality, integrity, and availability is significant and warrants immediate attention from security teams.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate and remove the WishList Member X plugin until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for suspicious requests containing serialized PHP objects or unusual POST data directed at the plugin endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block common PHP object injection patterns and restrict administrative or sensitive plugin access to authorized IP addresses only.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of object injection vulnerabilities, this issue poses a substantial threat to the integrity of the host server. IT administrators must prioritize the removal or containment of the affected plugin until a vendor-supplied update confirms the vulnerability is remediated. Continuous vigilance and strict adherence to the principle of least privilege for plugin access are essential to preventing exploitation.