The vulnerability is a PHP Object Injection flaw that arises from deserialization of untrusted data within the Ricky theme for WordPress. When attacker-controlled serialized data is processed, arbitrary PHP objects can be instantiated, leading to potential execution of malicious code. This flaw is mapped to CWE-502 and is rated with a CVSS score of 9.8, indicating that exploitation would allow attackers to take full control of the affected website, manipulate files, exfiltrate data, or hijack user sessions.

All installations of the Ricky theme supplied by park_of_ideas that use a version earlier than 2.31 are impacted. Sites running WordPress with this theme without an upgrade are at risk.

The EPSS score is less than 1 %, suggesting that malicious exploitation is currently unlikely, yet the high CVSS score warrants immediate attention. The attack vector is inferred to be remote, via any mechanism that allows an attacker to supply serialized data to the theme—such as form inputs, comments, or crafted URLs. Because the issue is not listed in the CISA KEV, there are no known widespread public exploits, but the inherent risk of remote code execution remains substantial.