Deserialization of untrusted data in Themeton Zuut theme allows an attacker to perform PHP Object Injection, enabling execution of arbitrary code on the affected WordPress site. The vulnerability stems from improper validation of serialized input, a weakness identified as CWE‑502. If exploited, an attacker could gain full access to the web application, compromise data integrity, and potentially pivot to the underlying server.

The defect affects the Zuut theme from the initial release (n/a) through version 1.4.2. All WordPress sites that have the Zuut theme installed and have not applied any mitigation beyond the default codebase are vulnerable.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is not available, but the KEV catalog lists it as not exploited in the wild as of the last update. The likely attack vector is remote, with a malicious actor sending crafted serialized data to the theme during a normal request; this inference is based on the nature of object injection in PHP applications.