The CVSS 7.2 score for this PHP Object Injection in Car Rental Manager <= 1.3.9 obscures a more dangerous reality. The vulnerability grants deserialization control to users with Contributor or Editor privileges — a threat model shift from external attacker to insider or compromised account. But the actual severity hinges entirely on what gadget chains exist in the plugin and its dependencies, and the EPSS score of 0.0037 reflects tooling gaps, not exploitability limits.
The critical insight is that WordPress does not enforce plugin boundaries at the class level. When this plugin loads, it inherits the full class registry of every active plugin on the instance. An Editor triggering the deserialization sink doesn't just access Car Rental Manager's classes — they access everything loaded in the WordPress ecosystem, including code that executes on their behalf during dashboard loads, AJAX handlers, and auto-saves. This transforms the vulnerability from authenticated privilege escalation into a potential server-side compromise vector, because the deserialization chain can draw from the entire plugin environment, not just this one.
Moreover, PHP Object Injection exploitation follows a documented wave pattern: each time a new gadget chain library publishes — PHPGGC releases, WooCommerce class analysis — previously theoretical RCE vectors become practical overnight. The low EPSS score captures the current absence of mass-exploitation tooling, but it's a lagging indicator. When someone publishes a gadget chain specific to this plugin's class landscape, expect EPSS to shift rapidly. The vulnerability window isn't static; it's a compounding period where unpatched instances become incrementally more exploitable with each new gadget library release.
Defenders should map every class loaded by the WordPress instance when this plugin is active, identify any magic methods (destruct, wakeup, __toString) in that class registry, and assess whether administrative code paths intersect with the deserialization sink. The patch addresses this specific version's sink, but the class registry state it leaves behind in unpatched installations compounds over time as the gadget landscape evolves.