This vulnerability arises from unsafe deserialization of untrusted data in the A WP Life Image Gallery plugin (versions ≤ 1.6.0). Deserialization flaws can allow attackers to inject malicious objects, potentially leading to remote code execution or other severe impacts. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and tracked as CVE-2026-22345 but lacks vendor patch or advisory details.

Successful exploitation of this vulnerability could allow an attacker with at least low privileges to execute arbitrary code or manipulate the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin functionality to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing the affected plugin to untrusted networks or users where possible.