Deserialization of untrusted data in the designthemes Dental Clinic WordPress theme (≤ 3.7) permits PHP Object Injection. An attacker can supply crafted input that causes PHP to instantiate arbitrary objects, potentially leading to code execution, data disclosure, or privilege escalation. The weakness is classified as CWE‑502, indicating that maliciously crafted serialized data is handled without proper validation.

Versions of the Dental Clinic theme supplied by designthemes with build numbers up to and including 3.7 are affected. The vulnerability applies whenever the theme processes user-supplied serialized data, such as through theme settings or AJAX callbacks in the front‑end. No other products or versions are listed as impacted.

With a CVSS score of 8.8 the issue is considered high severity. The EPSS score of < 1 % indicates that automated exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves inbound HTTP requests that contain the serialized payload, typically through the theme’s configuration interface or exposed REST endpoints. Successful exploitation would give an attacker remote code execution privileges on the WordPress installation, affecting confidentiality, integrity, and availability of the site.