This vulnerability in Post Duplicator (<= 3.0.10) arises from unsafe deserialization of untrusted data leading to PHP Object Injection (CWE-502). The CVSS 3.1 score of 8.8 indicates network exploitable with low attack complexity, requiring low privileges and no user interaction. Successful exploitation impacts confidentiality, integrity, and availability at a high level. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Exploitation of this vulnerability can lead to full compromise of the affected system, including arbitrary code execution, data disclosure, and disruption of service. The attacker requires only low privileges and can exploit remotely without user interaction, making it a significant risk for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid using vulnerable versions of Post Duplicator if possible.