A deserialization weakness in the WordPress FLAP – Business WordPress Theme allows an attacker to inject a crafted object that can be used to execute arbitrary PHP code. The flaw stems from the theme accepting untrusted data without proper validation, leading to object injection as identified by CWE-502. If an attacker succeeds, they could compromise the confidentiality and integrity of the site by executing custom code or escalating privileges.

Any installation of the FLAP – Business WordPress Theme version 1.5 or earlier is affected. The vulnerability impacts sites that employ this theme without updating to a newer, patched version.

The CVSS score of 9.8 classifies this issue as Critical, indicating a high impact if exploited. The EPSS score indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation would occur through a web request that feeds serialized data into the theme’s deserialization routine, possibly via a user‑controlled input such as a POST or GET parameter. Successful exploitation would enable arbitrary code execution on the server.