The extension passes an attacker-controlled cookie directly to the `unserialize()` function without safe processing. A remote, unauthenticated attacker can provide a crafted serialized payload to trigger PHP Object Injection, which allows for Remote Code Execution on the TYPO3 server. This issue occurs when the content element is configured with "Persistent Mode: Static" in the plugin settings. Over 294,700 TYPO3 CMS surfaces were indexed by FOFA in the past year.