A deserialization vulnerability allowing an attacker to inject arbitrary PHP objects into the WordPress Car Dealer Theme. This flaw, classified as CWE‑502, can enable the creation of malicious objects that result in arbitrary code execution. The impact is that a remote attacker could take control of the affected WordPress site, read or modify data, install backdoors, or deface the website.

Any WordPress installation running the ThemeMakers Car Dealer theme with a version prior to 1.6.8 is affected. The vulnerability applies to all releases from the first available version up to but not including 1.6.8.

The CVSS score of 9.8 indicates a critical severity, while the EPSS of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw remotely by sending crafted requests to the theme’s deserialization endpoints. If successfully exploited, the attacker would gain full code execution on the host.