Deserialization of untrusted data in the BoldThemes Addison WordPress theme enables arbitrary PHP object construction, permitting attackers to inject malicious objects and ultimately execute code on the server. The weakness, classified under CWE‑502, allows attackers to exploit the deserialization vulnerability if the theme’s deserialization routine is triggered by publicly accessible requests; this is inferred from the lack of stated authentication controls. This flaw can compromise the confidentiality, integrity, and availability of the affected WordPress installation, potentially allowing full system compromise.

All instances of the BoldThemes Addison theme with versions prior to 1.4.8 are affected. The vulnerability applies to every deployment of the theme that has not been upgraded past version 1.4.8.

The CVSS score of 9.8 highlights a severe risk, and while the EPSS score is reported as less than 1%, indicating a low probability of exploitation in the near term, the conceptual impact is high. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would likely target sites with the Addison theme by triggering the deserialization logic via crafted requests that introduce malicious objects into the application's data flow.