The Michael Cannon Flickr Shortcode Importer plugin versions up to 2.2.3 contain a deserialization of untrusted data vulnerability, enabling object injection attacks. This flaw allows an attacker with high privileges to supply crafted serialized data that the plugin unserializes insecurely, potentially leading to remote code execution or other severe impacts. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Because the attack requires high privileges, the threat is primarily to systems where an attacker already has elevated access. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and limit privileges to trusted users only. Monitor for updates from the vendor or security advisories for any released patches or mitigations.