The ChamaWP WordPress plugin versions prior to 1.0.13 do not properly validate user input before passing it to a PHP deserialization function. This flaw allows unauthenticated attackers to inject arbitrary PHP objects. When combined with a suitable gadget chain present in other installed code, this vulnerability can lead to remote code execution. The vulnerability is identified as CWE-502 (Deserialization of Untrusted Data) and has a CVSS v3.1 base score of 8.1, indicating high severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected system, leading to full compromise of the WordPress environment. The impact includes confidentiality, integrity, and availability being fully compromised (high impact on all three).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin or applying any recommended temporary mitigations from the vendor. Monitor official ChamaWP channels for updates.