The Hostme v2 WordPress theme contains a Deserialization of Untrusted Data flaw that enables an attacker to inject malicious PHP objects. This Object Injection can lead to arbitrary code execution on the site, allowing the attacker to compromise confidentiality, integrity, and availability. The weakness is classified as CWE‑502, a vulnerability that allows attackers to run code when the unserialize function processes externally supplied data.

The vulnerability affects all WordPress installations that use the Hostme v2 theme version 7.0 or earlier. Any site that has not updated to a later version inherits this flaw across all releases from the earliest unknown version through 7.0.

The CVSS score of 9.8 indicates critical severity, and the lack of an EPSS score does not diminish the likelihood of exploitation if the vulnerable endpoint is reachable; based on the description it is inferred that this endpoint can be accessed via a web request. The flaw is not listed in KEV, but it can be exploited through a crafted payload sent via a web request that triggers the theme’s deserialization routine. Based on the description, it is inferred that an attacker could supply malicious serialized data through a form or URL parameter, which the theme would then unserialize without proper validation.