The WP Easy Contact plugin for WordPress, up to version 4.0.1, contains a deserialization of untrusted data vulnerability that enables object injection. This type of vulnerability can allow an attacker to manipulate serialized data inputs to execute arbitrary code or cause other malicious effects. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or fix has been documented in the provided data.

Successful exploitation could lead to full compromise of the affected WordPress site, including unauthorized disclosure, modification, or destruction of data, and potential service disruption. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the WP Easy Contact plugin if feasible, or applying any recommended temporary mitigations from the vendor. Monitor vendor channels for updates.