Technical impact
Designthemes Single Property theme implements object deserialization of untrusted data, exposing PHP Object Injection. This flaw is classified as CWE-502 and can enable an attacker to instantiate arbitrary PHP objects, leading to remote code execution or privilege escalation on the affected WordPress site. The vulnerability is present in all releases of the theme from the initial version up to and including 2.8.
Affected Systems
WordPress sites that have the designthemes Single Property theme installed, version 2.8 or earlier, are affected. No additional products are listed; the theme itself is the sole impacted component.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1%% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The attack vector is inferred to involve an attacker supplying crafted serialized data to the theme, which is then deserialized without proper validation. While the exact entry point is not described in the advisory, it is reasonable to assume that any input channel that triggers deserialization could be abused, potentially allowing remote execution of arbitrary code on the host.
