The vulnerability is a deserialization of untrusted data in the DesignThemes Kriya WordPress theme. An attacker can supply a crafted PHP serialized object that the theme unserializes without proper validation, enabling arbitrary object injection. This flaw could lead to remote code execution or other privilege escalation within the web application, compromising the confidentiality, integrity, and availability of the site.

DesignThemes Kriya theme used in WordPress installations is affected from unspecified earlier versions up to and including 3.4. Users running any Kriya version 3.4 or earlier that have the unserialize code in place are vulnerable.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% shows that exploitation, while possible, is currently considered unlikely. The vulnerability is not in the CISA KEV catalog. Attackers would need to send malicious serialized data to the theme, likely via a query parameter, form, or API call. The lack of input validation allows object injection, which can be exploited to execute arbitrary code, modify the application’s behavior, or tamper with stored data.