The Capella theme contains a deserialization flaw that allows an attacker to inject malicious PHP objects. Because the theme processes untrusted serialized data, an attacker can craft a payload that, when deserialized, results in arbitrary code execution on the host server. The flaw is identified as CWE‑502 and is rated with a CVSS score of 9.8, indicating a severe threat to confidentiality, integrity, and availability.

This vulnerability affects the Capella theme from all unreleased releases through version 2.5.5. Any WordPress installation that has this theme or any older version deployed is potentially compromised. The vendor is ThemeGoods, and the product is the Capella WordPress theme.

The EPSS score of less than 1% suggests that the broader exploit probability is low, yet the high CVSS 9.8 severity signals that exploitation would be immediately damaging. The attack path does not require special environmental conditions; any legitimate route that triggers the theme’s deserialization logic can be abused. The vulnerability is not currently in the CISA KEV catalog, but an attacker could still target active installations if a malicious file or plugin supply chain path is available.