The Whitebox‑Studio Scape WordPress theme has a deserialization flaw that processes untrusted data, allowing object injection. This flaw, classified as CWE‑502, enables an attacker to craft PHP objects that may be instantiated during execution. Based on the description, it is inferred that such injection could lead to arbitrary code execution or other malicious actions depending on how the theme handles the deserialized objects.

The vulnerability affects the Scape theme from its initial release through version 1.5.13. Systems running any of these versions are vulnerable, while versions 1.5.14 and later have been patched.

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score of less than 1% suggests a low likelihood of current exploitation. It is not listed in CISA’s KEV catalog. The most likely attack vector is remote, as the theme’s deserialization logic can be triggered by web requests to a publicly exposed WordPress site that uses a vulnerable Scape version. Based on the description, it is inferred that an attacker could exploit the vulnerability via crafted web requests supplying malicious serialized data to the theme’s processing functions.