Editor PHP Object Injection in Zippy <= 1.7.0 versions.
WordPress sites using the Zippy plugin at version 1.7.0 or earlier are affected according to the available information. Exploitation requires high privileges, so the exposed population is limited to environments where an attacker can act as a highly privileged user.
The vector indicates network-reachable exploitation with low attack complexity and no user interaction, but it requires high privileges. An attacker would need authenticated high-privilege access before exploiting the PHP object injection issue.
The vulnerability is rated high with a 7.2 score and has high confidentiality, integrity, and availability impacts. Successful exploitation could therefore result in significant compromise of data, site content or configuration, and service availability.