This vulnerability involves unsafe deserialization of untrusted data in the WP Maps plugin (versions <= 4.8.6) by Flipper Code - WordPress Development Company. The flaw allows an attacker with high privileges to inject objects during deserialization, potentially compromising the confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required privileges, no user interaction, and impacts all three security properties (C, I, A) at a high level.

Successful exploitation could lead to complete compromise of the affected WordPress environment, including unauthorized data access, modification, or denial of service. The vulnerability requires high privileges to exploit and does not require user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to administrative interfaces and limit privileges to trusted users only to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.