The vulnerability is a deserialization of untrusted data flaw in the BoldThemes Nestin WordPress theme that permits PHP Object Injection. This can enable an attacker to instantiate arbitrary PHP objects and potentially execute remote code, leading to complete compromise of the affected WordPress site. The weakness is classified as CWE‑502, which denotes insecure deserialization.

Any instance of the BoldThemes Nestin theme with a version prior to 1.2.6 is impacted. This includes all versions listed as n/a through <1.2.6, meaning any deployment running a Nestin theme version older than 1.2.6 is vulnerable. WordPress sites that have not applied the 1.2.6 update remain at risk.

The CVSS score of 9.8 indicates a critical severity, and while the EPSS score of <1% suggests a very low current exploitation probability, the absence of the vulnerability from the CISA KEV list means there are no known large-scale active attacks. The likely attack vector is through the theme’s processing of user-supplied serialized data, such as form submissions or query parameters. An attacker who can inject malicious serialized payloads may trigger arbitrary code execution on the server.