The Holllelujah theme for WordPress contains a PHP Object Injection flaw caused by deserialization of untrusted data. This weakness allows an attacker to instantiate arbitrary PHP objects, which can then be leveraged to execute code on the hosting server. The flaw is identified as a CWE‑502 "Deserialization of Untrusted Data" vulnerability and can lead to a full compromise of the site and its underlying infrastructure.

All WordPress installations that use the Axiomthemes Hallelujah theme from its earliest release through version 1.1.1 are affected. No limitation to admin‑only or specific user roles is noted in the advisory; every user capable of triggering the vulnerable deserialization path could be at risk.

The CVSS score is 9.8, placing the issue in the critical range. EPSS data is not available, indicating the likelihood of exploitation is currently unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote and involves an attacker sending a crafted serialized payload—through a GET, POST, or other input parameter—to a part of the theme that unserializes user data. Successful exploitation would grant remote code execution and full authority over the affected web server.