The Reprizo theme handles user‑supplied data during deserialization without proper validation, leading to PHP Object Injection. An attacker crafting a serialized object can manipulate the application's deserialization process to invoke arbitrary methods on native PHP objects. Successful exploitation would allow the attacker to execute arbitrary code on the web server with the permissions of the WordPress process, potentially compromising the entire site, injecting malware, exfiltrating data, or creating a backdoor.

Software vendor axiomthemes provides the Reprizo WordPress theme. Versions from the earliest release to 1.0.8 are affected because the deserialization logic is present in all releases up to that version. Any WordPress site that installs or updates to any Reprizo <= 1.0.8 while the WordPress core is exposed to the internet is vulnerable.

The CVSS scored 9.8, indicating a high severity. EPSS is not available, so baseline exploitation potential is unknown, but the KEV catalog has not listed it, suggesting no known active exploitation spotted yet. The attack vector is likely remote, as WordPress sites are reachable over HTTP/HTTPS, and the vulnerability can be triggered by delivering a crafted serialized payload to the site, for example via a form, cookie, or any plugin that reuses the theme's serialization code. Because the vulnerability is a deserialization flaw, proper input filtering or disabling the feature would mitigate it, whereas lack of enforcement leads to full code execution.