Deserialization of untrusted data in the WordPress Jannah theme enables PHP object injection. When a maliciously crafted serialized string is processed, an attacker can instantiate arbitrary PHP objects and manipulate class properties, potentially leading to code execution or other privilege escalation within the web application. The very high CVSS score reflects this severe impact on confidentiality, integrity, and availability of the affected site.

The vulnerability affects the TieLabs Jannah WordPress theme, versions up to and including 7.6.0. Any site using Jannah 7.6.0 or earlier exposes the deserialization path and is at risk.

The CVSS score of 9.8 denotes critical severity, while the EPSS score of less than 1% indicates the probability of exploitation is currently low but not zero. The issue is not yet listed in CISA’s KEV catalog, but the high impact warrants immediate attention. Attackers would need to supply a serialized payload via a user‑controlled input vector; the exact vector is not specified in the advisory, so it is inferred that a request to a PHP endpoint that processes serialized data would be the entry point. No further prerequisites or privileges are documented, suggesting an unauthenticated or low‑privilege exploitation route.