The flaw is a deserialization of untrusted data that allows PHP object injection within the BoldThemes Avantage WordPress theme. By crafting a malicious payload, an attacker can create arbitrary PHP objects and trigger their magic methods, potentially leading to remote code execution, data theft, or site compromise. The vulnerability is classified under CWE‑502 and the official description indicates it affects all theme releases through version 2.4.9.

Any WordPress installation using the BoldThemes Avantage theme up to and including version 2.4.9 is vulnerable. This includes sites that have not applied the latest theme revision or have applied earlier patched releases before 2.4.9. The impact is confined to sites running the threatened theme and does not affect other WordPress components directly.

The CVSS score of 9.8 denotes critical severity, while the EPSS score of less than 1% suggests a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, the likely attack vector is remote via HTTP requests that trigger the theme’s deserialization logic. An attacker who can send a crafted payload to the affected WordPress site may achieve full code execution.