A critical object injection vulnerability in the Themify Popup plugin presents a high risk of unauthorized code execution on affected WordPress installations.

The plugin fails to properly sanitize user-supplied input before deserialization. This flaw allows an attacker to inject malicious objects, which can be leveraged to execute arbitrary code within the context of the web server.

The exploitation of this vulnerability carries a high business risk, as a successful attack could lead to a full compromise of the web server, data exfiltration, or site defacement. With a CVSS score of 8.8, this flaw represents a significant threat to organizational integrity and data confidentiality.

Immediate Action: Identify all instances of the Themify Popup plugin and update to the latest available version provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious serialized strings or unusual post requests directed toward the plugin’s endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious object injection patterns and suspicious serialized data payloads.

Public Exploit Available: false

Given the severity of object injection vulnerabilities, organizations should treat this as a high-priority item. Administrators must verify if their environment uses the affected plugin and apply the latest security updates immediately to prevent potential remote code execution.