The vulnerability is PHP object injection in the Entrepreneur – Booking for Small Businesses WordPress theme, affecting all releases up to 3.1.3. By inserting malicious serialized data, an attacker can cause the theme to deserialize untrusted input, potentially leading to arbitrary code execution on the server. The flaw is categorized as CWE‑502 and can compromise confidentiality, integrity, and availability of the site.

The product affected is the WordPress theme Entrepreneur – Booking for Small Businesses from Themovation. Versions 3.1.3 and earlier are vulnerable. Any WordPress installation that uses these theme versions and processes user input that reaches the deserialization logic is at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The flaw can likely be exploited remotely via the web interface that feeds serialized data to the theme’s PHP code. An attacker who can influence input fields or inject payloads could achieve remote code execution.