CraftCMS 3 vCard Plugin 1.0.0 is vulnerable to a deserialization vulnerability which can be exploited to achieve remote code execution. An attacker can craft a malicious payload and send it to the vulnerable endpoint to execute arbitrary code on the server.