The vulnerability originates from the deserialization of untrusted data within the Rhodos theme, enabling PHP Object Injection. Exploitation can allow an attacker to instantiate arbitrary objects, potentially leading to arbitrary code execution on the affected WordPress site.

The flaw affects the Axiom Themes Rhodos WordPress theme, with vulnerability present in all releases from the initial version through 1.3.3 inclusive.

This issue carries a CVSS score of 9.8, indicating critical severity. EPSS data is not available, so precise exploitation probability is unknown, but the lack of exploitation guidance in KEV suggests it has not yet been leveraged widely. Attacks would likely occur through any input path that triggers the theme’s unserialize logic, allowing remote attackers to pass malicious payloads.