The vulnerability involves the mishandling of serialized input data within the Mounthood theme, allowing an attacker to inject malicious PHP objects during deserialization. This flaw falls under CWE‑502 and can be leveraged to execute arbitrary code on the host, compromising confidentiality, integrity, and availability of the affected WordPress installation.

Affected products are the WordPress Mounthood theme from the vendor axiomthemes, with any release up through version 1.3.2. Versions beyond 1.3.2 are not impacted.

An attacker can exploit this flaw by submitting specially crafted serialized data to the theme’s processing routines, typically via a web request. The CVSS score of 9.8 classifies it as Critical, yet the EPSS score indicates that the probability of automated exploitation is currently less than 1 %. The vulnerability is not listed in CISA’s KEV catalog, but the high severity remains a significant risk, especially for sites that expose the theme’s data handling endpoints to Internet users.