The Consult Aid theme implements PHP deserialization of data supplied by users, permitting an attacker to inject arbitrary objects. If an attacker controls the serialized payload, they can instantiate malicious objects that may trigger code execution, privilege escalation, or server compromise. This flaw is a classic Object Injection vulnerability classified as CWE‑502.

The vulnerability affects the themeton Consult Aid theme for WordPress, versions up through and including 1.4.3. All installations of these versions are susceptible; no later releases are documented as affected.

The CVSS score of 9.8 marks this flaw as Critical, but an EPSS score of <1% indicates that exploitation is not yet widespread. The vulnerability is not listed in the CISA KEV catalog. Potential attackers with remote access to an affected WordPress site, or who can inject payloads via any deserialization endpoint, could potentially execute arbitrary code. The likelihood of exploitation depends on the attacker’s ability to manipulate deserialization input, which is inferred from the nature of the flaw.