This vulnerability (CVE-2024-25100) involves improper handling of untrusted serialized data in the WP Swings Coupon Referral Program plugin, enabling an attacker to perform object injection. This can lead to remote code execution or other severe impacts due to the deserialization of malicious input. The affected versions are all prior to 1.8.4, but the exact affected versions are not fully enumerated. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full system compromise, including remote code execution, data disclosure, and denial of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly critical. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor WP Swings official channels for updates and apply any forthcoming patches promptly.