The White Rabbit WordPress theme deserializes untrusted user input without proper validation, enabling PHP Object Injection. An attacker who can supply crafted payloads can instantiate arbitrary objects, potentially leading to remote code execution or data tampering. The vulnerability is aligned with CWE-502 and carries a CVSS score of 9.8.

Affected templates belong to the AxiomThemes White Rabbit theme for WordPress. Any installation using version 1.5.2 or earlier is vulnerable. Versions beyond 1.5.2 are considered patched.

The CVSS base score of 9.8 classifies the issue as Critical. EPSS indicates exploitation probability is less than 1 %. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread attacks yet, but the high severity score and lack of mitigations make it a high‑priority risk. Based on the description, it is inferred that the attack vector involves crafted requests to the theme’s deserialization endpoints. It is also inferred, due to the lack of explicit authentication requirements in the provided data, that no authentication is required if the theme’s endpoints are publicly accessible.