The Solar Energy theme for WordPress contains a deserialization weakness that allows untrusted data to be executed as a PHP object. This flaw enables an attacker to create malicious objects that, when unserialized, can execute arbitrary code on the server. The impact includes full compromise of confidentiality, integrity, and availability, as an attacker could inject backdoors or modify site content.

The vulnerability is present in the Solar Energy theme produced by designthemes for WordPress, affecting all installations using version 3.5 or earlier. Users running WordPress with this theme have a direct path for exploitation if untrusted data reaches the theme’s deserialization logic.

The CVSS score of 8.8 indicates a high severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The issue is not listed in CISA’s KEV catalog, meaning there is no confirmed widespread exploitation. The likely attack vector involves supplying crafted serialized input to the theme, perhaps through form fields, URL parameters, or theme settings that are not properly validated.