The divi-booster WordPress plugin is susceptible to unauthenticated arbitrary option modification and potential remote code execution via PHP object injection, posing a high security risk.

The plugin fails to perform authorization or CSRF checks, allowing unauthenticated attackers to modify internal plugin options. Furthermore, the use of unserialize() on user-supplied data facilitates PHP object injection, which may lead to code execution when combined with a suitable gadget chain.

Successful exploitation allows an unauthenticated attacker to alter site configurations, potentially leading to a complete compromise of the WordPress environment. Given the high CVSS score of 8.1, this vulnerability poses a significant risk of data loss, unauthorized access, and potential total system takeover.

Immediate Action: Update the divi-booster plugin to version 5.0.2 or later immediately to resolve the lack of authorization checks and the insecure deserialization flaw.

Proactive Monitoring: Review WordPress administrative logs for unauthorized changes to plugin settings or unusual PHP activity originating from the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious serialized PHP payloads and unauthorized administrative requests targeting plugin option endpoints.

Public Exploit Available: No (Exploit available is unknown/false).

This vulnerability represents a critical security oversight within the divi-booster plugin. Administrators must prioritize updating to version 5.0.2 or higher to eliminate the risk of remote code execution and unauthorized configuration changes. If an immediate update is not feasible, the plugin should be deactivated until a secure version is deployed.