CVE-2025-32647 describes a deserialization of untrusted data vulnerability in the PickPlugins Question Answer plugin, affecting versions up to 1.2.73. The flaw allows an attacker to perform object injection, potentially leading to remote code execution or other severe impacts. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. Exploitation requires network access and low privileges but no user interaction. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or manipulate application logic via crafted serialized data. The high CVSS score indicates critical impact on the security posture of affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected application and monitor for suspicious activity related to deserialization. Avoid processing untrusted serialized data where possible.