The vulnerability in the Meloo WordPress theme permits the injection of malformed serialized data. When the theme processes this data using PHP’s unserialize routine, it creates PHP objects controlled by the attacker, which may lead to unauthorized actions within the application.

All installations of the Meloo theme built by rascals that are earlier than version 2.8.2 are affected. The flaw exists regardless of the WordPress core version or other plugins installed. Any WordPress website that has deployed a vulnerable instance of the theme is therefore at risk.

The CVSS score of 8.8 signals a severe potential impact, while the EPSS score below 1% indicates that active exploitation is currently rare and the vulnerability is not listed in CISA’s KEV catalog. The likely attack avenue involves envi​ring the crafted serialized payload to the theme’s processing endpoint over the network, as the vulnerability is tied to the deserialization of untrusted data in a web context. The high severity score means that successful exploitation could grant considerable control if mitigations are missing, but the low probability of exploitation suggests that monitoring and preventive measures remain the most prudent approach.