The upgradeable WordPress theme Sala contains code that deserializes data without proper validation. This PHP Object Injection flaw allows an attacker to craft a serialized payload that, when processed by the theme, results in arbitrary PHP code execution on the host. The vulnerability is identified as CWE-502, which can lead to complete compromise of the affected website.

Any WordPress installation using uxper’s Sala theme version 1.1.3 or earlier is affected. The vulnerability exists in every release of the theme from its initial version up to and including 1.1.3. Systems running newer versions of the theme are not impacted.

The CVSS score of 8.8 signals a high severity exploit. While the EPSS score is reported as < 1%, indicating low current exploitation probability, the potential impact remains severe and the flaw is listed as not in the CISA KEV catalog. The likely attack vector appears to be a remote attacker sending a malicious serialized payload to a page or administrative endpoint that loads theme data, as the description explicitly states deserialization of untrusted data. Therefore, the threat is significant for any public‐facing WordPress site that activates the Sala theme without proper input sanitization.