The vulnerability is a deserialization of untrusted data flaw that allows an attacker to perform object injection and subsequently execute arbitrary code on the affected system. It is classed as CWE‑502, indicating that untrusted serialized data is improperly handled. If exploited, an attacker can gain complete control of the WordPress site, leading to data confidentiality and integrity compromise, and the ability to modify, delete, or exfiltrate content.

The Estate theme by axiomthemes for WordPress is affected. All released versions from the earliest available through version 1.3.4 are vulnerable. Only installations using a newer version or a different theme are immune.

The CVSS score is 9.8, classifying the vulnerability as critical. The EPSS score is below 1 %, indicating a very low current exploitation probability. The issue is not listed in CISA’s KEV catalog. The attack vector is not explicitly detailed in the advisory; based on the description it is inferred that exploitation can occur via any input path that the Estate theme processes, such as form submissions or administrative actions within WordPress. The flaw allows remote attackers with write access to the theme’s data handling routines to inject malicious objects.