This vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in the Holistic Center theme. It allows an attacker to instantiate arbitrary PHP objects and execute code within the WordPress environment, potentially compromising the confidentiality, integrity, and availability of the site. The flaw is classified as CWE-502, and the arbitrary code execution can be triggered by loading malicious serialized payloads into the theme’s processing flow.

The Holistic Center theme from axiomthemes, version 1.2.6 and earlier, is affected. This theme runs on WordPress installations that include the Holistic Center plugin files.

With a CVSS score of 9.8, the vulnerability is considered critical. No EPSS value is available and it is not listed in CISA’s KEV catalog, but the lack of mitigation still presents a high exploitation risk. The likely attack vector involves supplying malicious serialized data to the theme, such as through admin options or code injection points that accept user input directly without proper validation. Once exploited, an attacker can gain full control over the affected WordPress site.