The vulnerability is a Deserialization of Untrusted Data flaw that permits PHP Object Injection. An attacker who can supply a crafted serialized payload can instantiate arbitrary PHP objects in the context of the WordPress administration, potentially leading to arbitrary code execution or privilege escalation. The weakness is classified as CWE‑502. The impact could compromise the confidentiality, integrity, or availability of the WordPress site, and, if the attacker gains full control of the server, could affect the entire hosting environment.

The designthemes Vivagh theme, versions from the earliest release up to and including 2.4, is affected. Any WordPress installation that has this theme active is vulnerable; no other products or themes are listed.

The CVSS base score of 8.8 indicates a high severity vulnerability. The EPSS score is below 1 %, suggesting that the exploitation probability is low at this time. The vulnerability is not catalogued in CISA’s KEV. It is most likely to be exploited when an attacker can deliver a crafted serialized string via the theme’s processing path – for example, through an unfiltered user input or a malicious dashboard link. The exploit requires that the vulnerable theme’s component is executed in an authenticated context, therefore successful exploitation would likely target users with administrative or similar privileges.