NooTheme Yogi – Health Beauty & Yoga exposes a deserialization flaw that allows an attacker to inject arbitrary PHP objects into the WordPress theme. This untrusted data is later processed by PHP’s unserialize mechanism, which can trigger arbitrary code execution. The vulnerability is a classic instance of object injection, classified as CWE‑502, and it can compromise the confidentiality, integrity, and availability of the affected WordPress site if exploited.

The issue affects all installations of the Yogi – Health Beauty & Yoga WordPress theme with version numbers from the initial release through 2.9.2. Users of any WordPress host running these theme versions are potentially vulnerable. The vulnerability description does not list additional affected plugins or core versions.

The CVSS score of 8.8 indicates a high severity RCE risk. The EPSS score is reported as less than 1 %, implying that exploit attempts are currently very rare, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious user supplying serialized payloads via a form or cookie that the theme processes without validation. An attacker who can get the site to process such a payload could achieve full remote code execution.