Deserialization of Untrusted Data vulnerability in axiomthemes Redy theme allows an attacker to trigger PHP Object Injection by providing crafted serialized payloads. If the payload is executed, the attacker could achieve remote code execution, since the vulnerability permits arbitrary class instantiation and method invocation on untrusted input. The flaw is identified as CWE-502, indicating that dangerous objects are deserialized without sufficient validation, potentially compromising the confidentiality, integrity, and availability of the system.

The Redy WordPress theme from axiomthemes is affected in all releases up to and including version 1.3.5. The vulnerability applies to installations that have the theme enabled, regardless of the hosting environment or PHP version as long as the theme's deserialization logic remains unchanged. No other products or versions are listed.

The CVSS score of 9.8 places this bug in the Critical range, signifying a high likelihood of serious exploitation. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, but the lack of public exploitation data does not diminish the inherent risk. The attack vector is inferred to be remote, through web requests that transmit serialized data which the theme accepts and processes. An attacker who succeeds would gain the privileges of the web‑application user, potentially allowing full control over the affected WordPress installation. Because the flaw centers on deserialization of user-supplied data, it can be triggered without authentication if the theme’s deserialization code is publicly accessible.