This vulnerability in WP Project Manager (<= 4.0.6) arises from unsafe deserialization of untrusted data, enabling unauthenticated PHP object injection. An attacker can exploit this flaw remotely without any privileges or user interaction, potentially leading to full system compromise. The vulnerability is tracked as CWE-502 and has a CVSS 3.1 score of 9.8, reflecting critical severity. No official patch or remediation level has been published yet, and no known exploits are reported in the wild at this time.

Successful exploitation can lead to remote code execution with full impact on confidentiality, integrity, and availability of the affected system. Since the vulnerability is unauthenticated and network accessible, it poses a severe risk to any installations running vulnerable versions of WP Project Manager.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected plugin or disable it if possible to mitigate risk.