Designthemes Knowledge Base theme contains a PHP Object Injection flaw caused by deserializing data that is not fully validated. Attackers can supply a crafted payload that, when unserialized, creates an instance of a PHP object with malicious state, allowing the execution of arbitrary PHP code or modification of application logic. This results in a full Remote Code Execution condition, potentially compromising confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is identified as CWE‑502.

WordPress installations that employ designthemes Knowledge Base version 2.9 or earlier are vulnerable. No specific sub‑versions are enumerated beyond the <= 2.9 cutoff, so all iterations in that range should be considered at risk.

The CVSS score of 8.8 reflects high severity based on the ability to tamper with application logic and gain control. The EPSS score of < 1% indicates that, at present, documented exploitation attempts are rare, yet the vulnerability remains exploitable. It is not listed in the CISA KEV catalog. The attack likely requires delivery of a serialized payload via a web-facing endpoint that accepts user input, typical of WordPress theme behavior; this inference is based on standard theme functionality rather than explicit confirmation in the advisory.