A flaw in the axiomthemes m2 – Construction and Tools Store WordPress theme allows malicious users to send serialized data that will be deserialized by the theme code. When the data is untrusted, attackers can inject PHP objects that may execute arbitrary code during the deserialization process. This vulnerability is classified as a deserialization issue and is identified by CWE‑502.

WordPress installations that have the m2 theme installed in any version up to and including 1.1.2 are vulnerable. The vulnerability exists in every release of the theme from the first public release through version 1.1.2.

The severity rating of 9.8 on the CVSS score table shows a critical impact, while the EPSS score of less than 1 % indicates that, as of now, exploitation probability in the wild is modest. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no widespread publicly known exploits. The likely attack vector is inferred from the description: an attacker would need to craft a serialized payload and transmit it to the theme through a publicly accessible web request that triggers the deserialization routine. Successful exploitation would give the attacker full control over the affected WordPress site.