Deserialization of untrusted data in the Grand Tour theme allows PHP object injection, enabling an attacker to instantiate arbitrary PHP objects. The vulnerability can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected WordPress site. It is a classic deserialization flaw, classified as CWE-502, and can be exploited by sending crafted serialized payloads to the theme’s processing routines.

The affected product is the WordPress Grand Tour theme for WordPress, vendors ThemeGoods. All installations of Grand Tour from the earliest release up to and including version 5.6 are vulnerable. Any site using a version within this range must consider remediation or an upgrade.

The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% suggests a low current probability of widespread exploitation, but the lack of listing in the CISA KEV catalog does not reduce the potential threat. The likely attack vector is over the web interface, where an attacker can embed a malicious serialized object in an HTTP request that the theme processes. The combination of critical score and the ability to achieve arbitrary code execution means that any vulnerability exploitation would have total system compromise.