The deserialization vulnerability, now fixed, could have let attackers plant malicious code and backdoors on PayPal Manager.