The Au Pair Agency theme contains a vulnerability that deserializes data supplied from untrusted sources without proper validation. This flaw, classified as CWE‑502, allows an attacker to craft serialized PHP objects that, when processed by the theme, can trigger unintended behavior. In a PHP environment, deserialized objects may be instantiated or methods invoked, potentially enabling arbitrary code execution on the server.

This issue affects axiomthemes’ Au Pair Agency – Babysitting & Nanny Theme in all releases up to and including 1.2.2. WordPress sites that have installed and activated any of these versions are at risk. The vulnerability is confined to the theme's code, not the WordPress core.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1 % suggests that exploitation is currently considered unlikely or not widely observed. The vulnerability is not listed in the CISA KEV catalog, further indicating a low exploitation footprint. Based on the description, the likely attack surface is any input pathway that the theme processes with serialized data, for example theme options pages, AJAX handlers, or front‑end contact forms. Without additional validation, an attacker could load the crafted payload into such a pathway, leading to the object injection described above.