The Giveaway Boost plugin version 2.1.4 and earlier suffers from a deserialization of untrusted data vulnerability, enabling object injection attacks. This vulnerability allows remote attackers to execute arbitrary code or disrupt service without authentication. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity with network attack vector, low attack complexity, and no privileges or user interaction required. No patch or official fix information is available from the vendor, and the product is not a cloud service.

Successful exploitation can lead to full compromise of the affected system, including unauthorized code execution, data confidentiality breach, data integrity loss, and denial of service. The vulnerability affects all versions up to and including 2.1.4 of Giveaway Boost. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the Giveaway Boost plugin if possible to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.