The vulnerability CVE-2024-49222 affects WPGuppy (wpguppy-lite) plugin versions up to 1.1.0 and involves deserialization of untrusted data, enabling object injection attacks. This can allow an attacker to execute arbitrary code or manipulate application logic remotely without authentication or user interaction. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed and assigned by Patchstack, but no patch or official fix has been linked or announced yet.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code, leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the lack of required privileges or user interaction, the attack surface is broad. No known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected WPGuppy plugin versions or applying any recommended temporary mitigations from the vendor. Monitor official channels for updates.