The vulnerability is a deserialization of untrusted data that allows attackers to perform PHP object injection in NooTheme Yogi theme versions earlier than 2.9.3. If successfully exploited, an attacker could execute arbitrary PHP code, leading to full compromise of the affected WordPress site, including theft of data, defacement, or installation of malware (CWE-502).

The affected product is NooTheme Yogi, a WordPress theme. Versions from the initial release through any version before 2.9.3 are vulnerable.

The CVSS score is 8.8, indicating a high severity risk. The EPSS score is less than 1%, so the likelihood of exploitation in the wild is low at present, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to deliver crafted serialized data, likely through a user‑facing endpoint such as a REST API, Ajax request, or form input that the theme processes, which is inferred from the nature of PHP object injection. Because the deserialization occurs with untrusted input, an attacker could trigger the malicious payload if the site is reachable.