The iControlWP plugin for WordPress suffers from a PHP Object Injection vulnerability due to unsafe deserialization of untrusted data from the reqpars parameter. This vulnerability affects all versions up to and including 4.4.5. The absence of a POP chain within iControlWP itself means exploitation depends on the presence of a gadget chain in other installed plugins or themes. Successful exploitation could lead to high-impact consequences such as arbitrary file deletion, sensitive data disclosure, or remote code execution. The CVSS v3.1 base score is 9.8, reflecting critical severity with network attack vector, no privileges required, and no user interaction needed.

If exploited in an environment where a suitable POP chain exists in other plugins or themes, this vulnerability can lead to complete compromise of the affected WordPress site, including deletion of arbitrary files, disclosure of sensitive information, and remote code execution. Without a POP chain, the vulnerability cannot be exploited to cause harm.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should review installed plugins and themes for known POP chains and consider disabling or removing untrusted or unnecessary components that could facilitate exploitation. Monitoring vendor channels for updates on an official fix is recommended.