The vulnerability is a deserialization of untrusted data (CWE-502) in the BoldThemes Codiqa WordPress theme, which allows an attacker to inject malicious PHP objects. If an attacker can supply crafted serialized data that the theme processes, malicious objects may be instantiated, potentially leading to unauthorized code execution or other disruptive behaviors. The impact therefore includes the risk of arbitrary code execution, breaking the confidentiality and integrity of the WordPress site.

BoldThemes Codiqa theme versions earlier than 1.2.8, from the earliest release up to but not including 1.2.8, are affected. Any installation running a version of the theme before the 1.2.8 release is at risk.

The CVSS score of 9.8 marks this flaw as critical severity. However, the EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is very low. The theme is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Attackers must be able to supply arbitrary serialized data that the theme will attempt to unserialize; the most likely attack vector is remote, via publicly accessible endpoints or user input that is not properly sanitized.