The vulnerability CVE-2025-32686 affects the WPSpeedo Team Members plugin for WordPress, specifically versions up to 3.4.4. It is caused by unsafe deserialization of untrusted data, enabling an attacker with at least low privileges to inject malicious objects. This can result in full compromise of the system's confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and the product is not a cloud service.

Successful exploitation allows an attacker with low privileges to perform object injection via deserialization of untrusted data, potentially leading to full system compromise including data theft, modification, or denial of service. The high CVSS score (8.8) indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin functionality to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid exposing the affected plugin to untrusted inputs where possible.