The vulnerability is a deserialization of untrusted data that allows PHP object injection in the Tasty Daily WordPress theme. Object injection can be leveraged to manipulate the application’s state and can ultimately lead to execution of arbitrary code on the server, compromising confidentiality, integrity, and availability of the hosting environment.

WordPress installations running the park_of_ideas Tasty Daily theme prior to version 1.27 are affected. The vulnerability applies to all releases from the earliest available version through any version smaller than 1.27.

With a CVSS score of 9.8, the flaw is classified as critical. The EPSS score is below 1% and the issue is not in the CISA KEV catalog, suggesting that widespread automated exploitation is currently unlikely. However, the abuse path likely requires an attacker to trigger the deserialization process, possibly via a crafted request or unauthenticated access to a deserialization endpoint. If an attacker can supply arbitrary serialized data, they can gain code execution.