This vulnerability involves unsafe deserialization of untrusted data in the Muzaara Google Ads Report plugin (up to version 3.1). An attacker can exploit this flaw to perform object injection, potentially leading to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability without requiring privileges or user interaction. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation can result in full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version if possible. Monitor vendor channels for updates and apply patches promptly once available.