The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in the Kids Heaven theme. An attacker who can craft a payload that influences the theme’s internal state could instantiate arbitrary objects, potentially leading to execution of unintended code or manipulation of the application. This flaw belongs to CWE-502 and provides a direct path to compromise the integrity and confidentiality of the site.

The issue affects the DesignThemes Kids Heaven theme for WordPress in all releases from the earliest version up through 3.2. Any instance of this theme that has not been upgraded beyond 3.2 is potentially vulnerable.

The CVSS score of 8.8 reflects a high severity and the EPSS score of less than 1% indicates that current exploitation probabilities are low but not negligible. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation has been documented. Based on the description, the likely attack vector involves sending crafted HTTP requests that trigger the theme’s deserialization routine, which may require an authenticated WordPress session with access to theme settings or the ability to influence theme options.