Deserialization of untrusted data occurs within the Noisa WordPress theme, enabling PHP Object Injection. The vulnerability allows an attacker to craft serialized input that creates malicious objects when processed by the theme. This can lead to arbitrary code execution, data disclosure, or other malicious actions on the affected website. The weakness corresponds to CWE‑502.

The affected product is the WordPress Noisa theme from the vendor rascals. All releases up to version 2.6.0, inclusive, are vulnerable. No specific subversion details are provided beyond the "<= 2.6.0" boundary.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score of less than 1% indicates that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the high severity and typical remote nature of PHP Object Injection suggest a likely attack vector of issuing crafted HTTP requests to the theme’s endpoints, potentially from unauthenticated or authenticated users depending on the exposed functionality. Prompt remediation is advised.