The flaw is a PHP Object Injection vulnerability caused by the deserialization of untrusted data in the Work & Travel Company theme. An attacker can supply crafted serialized data that the theme blindly deserializes, allowing the creation of arbitrary PHP objects and execution of arbitrary code. This leads to full compromise of the WordPress site, including data theft, defacement, and potential pivot to other systems. The issue is identified as CWE‑502, insecure deserialization, and carries a CVSS score of 9.8.

The vulnerability impacts the WordPress Work & Travel Company theme released by ThemeREX. All versions from the earliest release up through version 1.2 are affected. Any WordPress installation using this theme in those versions is potentially vulnerable.

The high CVSS score indicates a severe threat, yet the EPSS score of less than 1% suggests low current exploitation activity. Because the flaw enables remote code execution via a typical web request, any publicly exposed WordPress site running the affected theme faces a significant risk. The vulnerability is not listed in the CISA KEV catalog, but no official patch is currently available, so administrators must act quickly by upgrading or disabling the theme. An attacker could exploit this by sending a crafted payload to the site’s public interfaces, triggering deserialization and executing arbitrary code. The overall risk is high, warranting immediate attention and mitigation.