The vulnerability is a deserialization flaw that allows an attacker to inject and execute arbitrary PHP objects. By supplying maliciously crafted serialized data to the CouponXxL theme, an attacker can trigger code execution with the privileges of the web application. This type of object injection can be leveraged to compromise the entire WordPress site, potentially leading to full system takeover. The weakness is categorized as CWE‑502, indicating that untrusted data is being deserialized without sufficient validation.

WordPress installations that use the pebas CouponXxL theme version 3.0.0 or earlier are affected. Any site that has not yet upgraded beyond this version is vulnerable. The vulnerability affects the theme itself, not the core WordPress software or other plugins.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% suggests that, based on current data, the probability of exploitation in the wild is low, yet the potential impact remains extremely high. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploit has been reported. The attack is most likely carried out remotely through crafted HTTP requests that include serialized data processed by the theme, meaning any exposed form or endpoint that accepts user input could be a potential entry point.