A PHP Object Injection flaw exists in the Red Art WordPress theme through version 3.8. The vulnerability arises from deserialization of untrusted data, allowing an attacker to supply malicious serialized payloads that are later interpreted by the theme without adequate validation. This flaw is identified as CWE-502 and is capable of delivering Remote Code Execution, giving the attacker control over the affected WordPress site.

The Red Art theme, released by designthemes, is impacted from its initial release up to and including version 3.8. All WordPress installations using any version of the theme that is 3.8 or older are considered vulnerable. No evidence suggests that versions newer than 3.8 are affected.

The CVSS score of 8.8 classifies this as a high severity vulnerability. The EPSS score of less than 1% indicates that, as of the data available, exploitation attempts are rare. The flaw is not listed in the CISA KEV catalog. Attackers could exploit the flaw through a specially crafted request that triggers the theme’s deserialization logic, such as an improperly sanitized form or API endpoint; this inference is based on typical WordPress theme handling of serialized input. Successful exploitation would compromise integrity, confidentiality, and availability, potentially giving attacker full control of the WordPress site.