This vulnerability is a PHP object injection flaw caused by the deserialization of untrusted data within the MediCenter – Health Medical Clinic theme for WordPress. An attacker who can supply crafted serialized payloads could cause the server to instantiate arbitrary PHP objects, allowing execution of arbitrary PHP code and full compromise of the web application. The weakness is identified as CWE-502 and the impact is remote code execution, potentially leading to data theft, defacement, or further lateral movement on the host.

The affected product is the MediCenter – Health Medical Clinic theme distributed by QuanticaLabs. All releases from the earliest available version through and including version 15.1 are vulnerable. No specific minor revisions were listed, so any instance of the theme at or below 15.1 is considered at risk.

The CVSS score of 9.8 places this flaw in the highest critical severity range. The EPSS score is reported as less than 1 %, indicating a very low but non‑zero probability of exploitation in the wild; however, the lack of a KEV listing does not exclude the possibility of targeted attacks. The likely attack vector is remote, via HTTP requests that deliver malicious serialized data to the theme’s processing functions. The flaw is inferred to be exploitable without requiring authenticated access, meaning any visitor could potentially trigger it.