The vulnerability is a PHP Object Injection flaw that occurs when untrusted serialized data is deserialized without proper validation. A crafted payload can embed malicious objects, enabling an attacker to execute arbitrary code on the web server. This weakness, identified as CWE-502, can compromise confidentiality, integrity, and availability of the affected WordPress installation.

The issue affects the BoldThemes Ippsum theme for WordPress, versions from the earliest release through 1.2.0 inclusive. The theme is distributed under the BoldThemes vendor umbrella and is commonly installed on public websites that rely on WordPress as their content management system.

The CVSS score of 9.8 reflects the severity of the potential impact. The EPSS score is less than 1% indicating that, at this time, the probability of real‑world exploitation is low, but the vulnerability is still serious if it is discovered. The flaw is not listed in the CISA KEV catalog. Attackers would need to supply a malicious serialized payload through an exposed input—most likely an upload or URL parameter—where the theme blindly unserializes data. Based on the description, it is inferred that the attack vector requires an authenticated or unauthenticated HTTP request that reaches the deserialization point and that the victim’s server environment supports PHP object injection. This combination gives the attacker a path to remote code execution if the server’s PHP configuration does not restrict allowable classes during unserialize.