The Themesflat Elementor plugin for WordPress contains a deserialization of untrusted data flaw that allows PHP Object Injection. An attacker can inject crafted serialized objects into the plugin’s input processing, which can lead to arbitrary code execution on the affected web server. The weakness is a classic instance of unchecked data deserialization as captured by CWE-502, and the impact includes full compromise of the target system’s confidentiality, integrity, and availability.

WordPress sites using the Themesflat Elementor plugin version 1.0.1 or older are affected. The vulnerability applies to all installations where the plugin package is present, regardless of other security controls, because the flaw is triggered by untrusted input handled directly by the plugin code.

The CVSS score of 9.8 marks the flaw as critical, the EPSS score of less than 1% indicates that exploitation is rare, and the flaw is not listed in KEV. The threat vector is remote, likely through HTTP data that is unserialized by the plugin without validation. An attacker controlling such input can drive the deserialization routine to execute arbitrary PHP code, effectively compromising the web server and all data it hosts.