A deserialization flaw in the PeakShops WordPress theme allows an attacker to inject a crafted PHP object. This uncontrolled object injection can lead to the execution of arbitrary code or other dangerous behaviors, satisfying the weakness described as CWE-502. The vulnerability specifically targets the theme’s handling of untrusted serialized data.

The PeakShops theme by Fuelthemes, versions up to and including 1.5.9, are affected. All installations of the theme from its initial release through version 1.5.9 contain the flaw.

The CVSS score of 8.8 indicates high severity. The EPSS score is under 1%, suggesting that exploit attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw by supplying malicious serialized input to the theme’s deserialization routine, which could be delivered via a crafted request or injection vector. Because object injection typically permits remote code execution, the risk to confidentiality, integrity, and availability is significant, but the actual exploitation path has not been explicitly confirmed in the public description.