This vulnerability involves deserialization of untrusted data in the GiveWP plugin by StellarWP, which enables object injection attacks. It affects all versions up to 3.19.3. The CVSS 3.1 base score of 9.8 reflects that the vulnerability can be exploited remotely without authentication or user interaction, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is publicly disclosed but no known exploits in the wild have been reported. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary code or manipulate application behavior, leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score, the impact is severe, potentially enabling remote code execution or other high-impact consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the affected GiveWP plugin versions. Monitor official StellarWP channels for updates and apply patches promptly once released.