The vulnerability is a deserialization flaw that allows PHP Object Injection when the Crafts & Arts theme processes untrusted data. An attacker could forge serialized payloads that instantiate arbitrary objects, potentially leading to execution of malicious code, unauthorized data access, or manipulation of the WordPress site. The weakness is categorized as CWE-502, reflecting the risk from unsafe deserialization.

The defect affects the DesignThemes Crafts & Arts WordPress theme for all releases up to and including version 2.5. Any WordPress installation that uses any of these versions of the theme is vulnerable.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through the web application, where an attacker can supply crafted serialized data—such as through form inputs or URL parameters—to the theme’s processing functions to trigger the object injection. If exploited, the attacker could gain full control over the hosting environment.