The vulnerability is a deserialization of untrusted data in the WordPress OneLife theme. An attacker could provide a crafted serialized payload that is processed by the theme, allowing PHP Object Injection and enabling arbitrary code execution on the web server. The weakness is classified as CWE‑502, reflecting insecure deserialization.

WordPress .oneLife theme from designthemes, versions up to and including 3.9 are affected. Any WordPress installation using this theme within that version range is vulnerable.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% shows a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, achieved by sending a specially crafted serialized object through a request to the theme. Because the deserialization occurs on the server side, an attacker can gain full control of the PHP runtime on the affected host, leading to complete compromise.