The Pendulum WordPress theme contains a deserialization vulnerability that allows an attacker to inject arbitrary PHP objects. This PHP Object Injection can enable the execution of malicious code, granting the attacker full control over the affected website. The weakness can compromise the integrity and confidentiality of site data and potentially lead to remote code execution. It is classified as CWE‑502, indicating unsafe handling of serialized data.

The vulnerable component is the Pendulum theme developed by rascals. All releases of Pendulum older than and including version 3.1.4 are affected; the problem is resolved in version 3.1.5 and later. Users running any prior version of the theme on WordPress should review their installation and determine whether an upgrade is required.

With a CVSS score of 8.8, the issue is considered high severity. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present, and the vulnerability has not yet been catalogued in the CISA KEV list. The attack vector is inferred to be remote, likely through a web interface that accepts serialized data, such as form submissions or query parameters, although the exact entry points are not specified in the description. The high exploitability rating combined with the limited occurrence suggests that targeted attacks on vulnerable sites, especially those exposed to the internet, remain the principal risk.