This vulnerability in Cozmoslabs TranslatePress (<= 2.9.6) arises from unsafe deserialization of untrusted data, enabling an attacker with high privileges to perform object injection. The CVSS 3.1 score of 7.2 reflects the network attack vector, low attack complexity, required high privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The issue affects the translatepress-multilingual component and was published on March 27, 2025. No patch or vendor advisory details are currently available.

Successful exploitation allows an attacker with high privileges to inject malicious objects via deserialization, potentially leading to full compromise of the system's confidentiality, integrity, and availability. Since the attack requires network access and high privileges, the risk is significant but limited to users with elevated permissions. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and monitor for suspicious activity related to deserialization processes in TranslatePress. Avoid exposing the vulnerable component to untrusted networks or users with elevated privileges.