The Noisa WordPress theme contains a PHP object injection flaw due to deserialization of untrusted data. This CWE‑502 weakness allows an attacker to craft malicious serialized objects that, when processed by the theme, can lead to arbitrary code execution on the web server. The impact is the ability for an adversary to run code, modify data, or take full control of the site. Based on the description, it is inferred that an attacker can exploit the vulnerability by crafting a malicious serialized object and sending it to a theme endpoint that accepts user input.

The vulnerability affects the Noisa theme by rascals for all releases from the initial release through version 2.6.0. Any WordPress installation that has the Noisa theme at or below this version is at risk.

The CVSS score of 8.8 signifies high severity, while the EPSS score of less than 1% indicates a currently low but non–zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves sending a crafted serialized payload to any endpoint of the theme that accepts user input—such as theme options or form submissions—thereby achieving code execution if the payload is processed. No special privileges are required beyond the ability to influence the data processed by the theme.