ThemeGoods Grand Conference theme contains a deserialization of untrusted data flaw, classified as PHP Object Injection (CWE-502). When an attacker can supply serialized data that is later unserialized by the theme, malicious objects can be instantiated, enabling arbitrary code execution or manipulation of the application’s state. The vulnerability is severe, with a CVSS score of 9.8, indicating that successful exploitation could compromise the confidentiality, integrity, and availability of the affected WordPress site.

The Grand Conference WordPress theme from ThemeGoods is affected. All releases through version 5.3, including any 5.3.x, are vulnerable. No further product or version details are available beyond the noted range.

The low EPSS score (< 1%) suggests that exploitation is unlikely to be widespread or automated at present, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is inferred to require the attacker’s ability to submit data that is deserialized by the theme, such as through form inputs, POST requests, or any mechanism that feeds serialized values to the theme’s code. The high CVSS score emphasizes the criticality of gaining remote code execution if the flaw is triggered.