The vulnerability in the NooTheme CitiLights WordPress theme is a PHP Object Injection flaw caused by deserialization of untrusted data. Attackers can supply crafted serialized payloads that result in the instantiation of arbitrary PHP objects when the theme processes them. The flaw, classified as CWE-502, may allow attackers to compromise the confidentiality, integrity, or availability of the site content and potentially other data stored by the WordPress installation.

All WordPress installations that have the CitiLights theme running any version up to and including 3.7.1 are impacted. The issue affects the theme across all hosting environments where the theme is activated, regardless of server configuration.

With a CVSS base score of 8.8 the vulnerability is considered high severity, but the EPSS score of less than 1% indicates a currently low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be any part of the theme that accepts serialized input, such as theme options or front‑end forms, which would allow an attacker to trigger the object injection.