The ColorFolio theme contains a flaw where it deserializes untrusted data, permitting object injection. While the CVE description does not explicitly state that code execution is achieved, object injection typically can lead to arbitrary code execution on a WordPress installation, potentially compromising confidentiality, integrity, and availability. The potential impact is therefore judged to be significant, but the exact consequence (e.g., remote code execution) is inferred based on the nature of the vulnerability rather than directly stated in the source.

The vulnerability affects the BuddhaThemes ColorFolio - Freelance Designer WordPress Theme, specifically all releases from the earliest available version through version 1.3 inclusive. No additional sub‑product or variant information is provided.

The CVSS score of 8.1 indicates a high severity level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as the theme is accessible via a web interface and the deserialization routine could be triggered through a public‑facing form or API endpoint. This assessment of the attack vector is inferred from the description rather than explicitly documented in the CVE data. The overall risk is high due to the severity score and the potential for serious compromise if the flaw is exploited.