The vulnerability is an instance of deserialization of untrusted data in the Helion theme for WordPress. Because the theme calls PHP's unserialize function on user-controlled input, an attacker can inject crafted objects, potentially enabling remote code execution, data exfiltration, or other malicious activities. The issue is categorized as CWE‑502, improper handling of unserialized data.

This flaw affects all releases of the Helion theme up through 1.1.12. WordPress sites that have deployed the Helion theme version 1.1.12 or older are vulnerable, regardless of the WordPress core version.

The CVSS base score of 8.1 reflects high severity. EPSS data is unavailable, so the exact likelihood of exploitation is indeterminate, but the nature of the flaw allows an attacker to inject arbitrary objects without privileged access. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploit. The attack vector is likely remote: an adversary can craft a request that the theme deserializes, such as a malicious comment, form submission, or query string, leading to object injection.