A critical PHP object injection vulnerability in the INFINITUM FORM Geo Controller plugin enables unauthenticated attackers to achieve remote code execution.

The flaw exists due to insecure deserialization of untrusted data (CWE-502) within the plugin. An unauthenticated remote attacker can supply malicious serialized objects to the application, leading to arbitrary code execution on the underlying server.

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation grants an attacker full control over the affected web server, potentially leading to total system compromise, unauthorized data exfiltration, and significant reputational damage.

Immediate Action: Update the INFINITUM FORM Geo Controller plugin to version 8.9.9 or the latest available version immediately.

Proactive Monitoring: Monitor server access logs for unusual serialized string patterns or suspicious POST requests targeting the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization payloads targeting PHP applications.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and the lack of authentication required for exploitation, immediate patching is required. Organizations using the Geo Controller plugin must prioritize upgrading to version 8.9.9 to eliminate the risk of remote code execution and potential full system compromise.