Deserialization of untrusted data in the Prestige theme allows object injection, which can be leveraged to create arbitrary PHP objects that execute attacker‑supplied code. This weakness directly permits full control over the server process, compromising confidentiality, integrity, and availability of the affected WordPress installation.

The vulnerability impacts the Jthemes Prestige theme on WordPress installations running any version prior to 1.4.1. It does not affect later releases or other themes.

The CVSS score of 9.8 indicates critical severity. While the EPSS score is currently less than 1 %, indicating a low probability of widespread exploitation, the flaw is not yet listed in the CISA KEV catalog, meaning it has not yet been widely compromised. Based on the description, it is inferred that an attacker can likely reach the deserialization point via a crafted HTTP request to the theme’s endpoints, but no specific deployment scenario is documented. The lack of a mitigation in the criticality, combined with the CVSS, warrants urgent attention.