Deserialization of untrusted data within the Grand Wedding theme allows an attacker to inject crafted PHP objects. Such object injection enables the execution of arbitrary code on the server, potentially compromising the entire WordPress installation. The flaw is a classic insecure deserialization vulnerability classified as CWE‑502, posing a severe risk to confidentiality, integrity, and availability.

The vulnerability affects ThemeGoods’ Grand Wedding WordPress theme versions up to 3.1.10 inclusive. Any site that has installed or is still using a version at or below 3.1.10 is potentially exposed. No other vendors or products are listed as impacted.

With a CVSS score of 9.8, the vulnerability is considered High severity. The EPSS score of less than 1% indicates a low probability of widespread exploitation at present, and the issue is not listed in the CISA KEV catalog. However, the flaw can be abused through standard web requests to the WordPress site, where the theme processes serialized data. Attackers would need to supply a malicious payload via any input that the theme accepts, so the main vector is the web application itself rather than external network services.