Potenzaglobalsolutions CiyaShop suffers a Deserialization of Untrusted Data vulnerability (CWE-502) that allows PHP Object Injection. A malicious actor can supply crafted serialized data, causing the application to instantiate objects with attacker-controlled properties and execute arbitrary code on the server. The CVSS score of 9.8 indicates a critical severity, meaning the potential impact includes complete compromise of the WordPress site and any connected services.

The vulnerability affects the WordPress CiyaShop theme provided by Potenzaglobalsolutions, impacting all releases up to and including version 4.18.0. Both the theme and its associated WordPress installation are at risk if the affected theme is active.

Despite the high CVSS score, the EPSS score is reported as less than 1%, suggesting that widespread exploitation is currently low. The attack vector is inferred to be the injection of malicious serialized objects via inputs that the theme processes, such as theme options, widgets, or administrative interfaces. Because the vulnerability is not listed in CISA’s KEV catalog, there is no known active exploitation at the time of this analysis, but the potential for exploitation remains high and should be treated as a critical threat.