Deserialization of untrusted data in the WoodMart WordPress theme creates a PHP Object Injection weakness that allows an attacker to craft serialized payloads that become arbitrary PHP objects within the application. This flaw, identified as CWE‑502, can enable an attacker to execute custom code on the affected site, potentially leading to full site compromise.

The vulnerability exists in all releases of the WoodMart theme by xtemos up to and including version 8.3.8. Any site running one of these versions without an upgrade to 8.3.9 or later is exposed. Earlier releases are potentially affected as well unless explicitly patched for this issue.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation, though the threat remains. The flaw is not listed in the CISA KEV catalogue. The likely attack vector is through any user-supplied data that the theme deserializes, such as query parameters, form submissions, or uploaded content. Based on the description, it is inferred that an attacker can trigger the vulnerability remotely by supplying crafted serialized input that the theme processes without proper validation.