The Houzez WordPress theme contains a PHP Object Injection flaw within the saved-search-item.php module. Unsanitized input is deserialized, allowing an attacker who is logged in as a Subscriber or higher to construct a malicious PHP object. By exploiting this vulnerability, the attacker could inject any object type that the environment processes during deserialization, creating the possibility of arbitrary code execution when the object’s magic methods are invoked.

All releases of the Favethemes Houzez theme up to and including version 4.1.6 are affected. The vulnerability resides in the core theme code and is not limited to a single component beyond the saved-search-item.php script.

The CVSS score of 6.3 indicates medium severity, while an EPSS score of less than 1 % suggests a low likelihood of real‑world exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with at least Subscriber level privileges and the presence of a separate plugin or theme that supplies a PHP Object Playground chain; without such a chain the vulnerability alone does not produce impact.