This vulnerability involves deserialization of untrusted data in the elbisnero WordPress Events Calendar Registration & Tickets plugin (wpeventplus), versions up to 2.6.0. The flaw allows an attacker to perform object injection, which can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability with no required privileges or user interaction and exploitable over the network. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code or manipulate application data, resulting in full compromise of the affected WordPress site. The vulnerability impacts confidentiality, integrity, and availability severely as indicated by the CVSS score of 9.8. No known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected plugin to prevent exploitation. Monitor official elbisnero and WordPress security channels for updates and apply patches promptly once released.