Deserialization of untrusted data in Themeton Zuut theme allows an attacker to perform PHP Object Injection, enabling execution of arbitrary code on the affected WordPress site. The vulnerability stems from improper validation of serialized input, a weakness identified as CWE‑502. If exploited, an attacker could gain full access to the web application, compromise data integrity, and potentially pivot to the underlying server.

The defect affects the Zuut theme from Themeton, from the initial release (n/a) through version 1.4.2. All WordPress sites that have the Zuut theme installed and have not applied any mitigation beyond the default codebase are vulnerable.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is < 1%, and KEV indicates it has not been listed. The likely attack vector is remote, with a malicious actor sending crafted serialized data to the theme during a normal request; this inference is based on the nature of object injection in PHP applications.