The PGS Core plugin for WordPress suffers from a PHP Object Injection vulnerability due to unsafe deserialization of untrusted data in the 'import_header' function. This vulnerability affects all versions up to and including 5.8.0. An unauthenticated attacker can supply crafted serialized data to inject PHP objects. Although the plugin does not include a known POP chain, the presence of other plugins or themes that provide such chains could enable severe impacts including arbitrary file deletion, data leakage, or code execution. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit this vulnerability to inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or remote code execution if a POP chain is available through other installed components. The vulnerability affects confidentiality, integrity, and availability with a critical severity rating (CVSS 9.8). No known exploits are currently reported in the wild.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the PGS Core plugin if possible, or restrict access to the vulnerable functionality. Monitoring for updates from Potenza Global Solutions is recommended to apply an official fix once available.