Deserialization of untrusted data in the WordPress Pet World theme (versions up to 2.8) allows PHP object injection. This flaw lets an attacker create arbitrary PHP objects during the deserialization process, enabling remote code execution or other forms of privilege escalation on the affected WordPress installation. The issue is classified as CWE‑502, highlighting the dangers of unserializing data from untrusted sources.

The Pet World theme from designthemes, any release version 2.8 or earlier, is vulnerable. WordPress sites that have this theme installed are at risk, regardless of other security measures.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% shows a low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, involving an attacker sending a malicious serialized payload to the theme’s deserialization endpoint over HTTP, which could be triggered by a user‑supplied input field or a crafted POST request. No explicit access or privilege constraints are mentioned, so normal users with the ability to interact with the theme could potentially exploit this flaw.