The Hillter theme contains a deserialization flaw that allows attacker controlled serialized data to be parsed by the PHP runtime, resulting in PHP Object Injection. This weakness can enable arbitrary code execution and compromise the confidentiality, integrity, and availability of the affected WordPress site.

AweThemes Hillter theme versions from the earliest release through 3.0.7 are affected.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% shows that the exploitation probability is currently very low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through any WordPress request that accepts serialized input, such as form data or URL parameters, that can be crafted by an attacker to inject malicious objects.