The flaw is a deserialization of untrusted data in the Codetipi Valenti WordPress theme, allowing PHP object injection. This weakness, classified as CWE‑502, could potentially enable an attacker to execute code on the site, representing a high‑risk impact.

All installations of the Valenti theme for WordPress versions 5.6.3.5 and earlier are affected. No specific WordPress core version is required; any site running the vulnerable theme is at risk.

With a CVSS score of 8.8, the vulnerability is high severity, though its EPSS score of less than 1% indicates a very low probability of exploitation at present, and it is not listed in the KEV catalog. The likely attack vector is through user‑supplied input that the theme deserializes; a successful exploit would allow code execution within the WordPress web context. Because the fix is not publicly referenced, users should treat this flaw as an urgent risk.