Deserialization of untrusted data in the Goldenblatt WordPress theme can cause PHP Object Injection (CWE-502), which allows an attacker to execute arbitrary code on the server. This flaw enables the attacker to gain full control over the affected WordPress site, potentially compromising all data stored on the server.

The vulnerability affects the BoldThemes Goldenblatt theme versions prior to 1.3.0. Any WordPress installation that is running Goldenblatt 1.2.1 or earlier is susceptible.

According to the CVSS score of 9.8, the risk is extremely high. The EPSS score of less than 1% indicates a low current exploitation probability, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, because an attacker could inject malicious objects via application inputs, the flaw is considered remotely exploitable. Organizations should assume a high severity risk if the vulnerable theme remains active.